External risk intelligence

Linux Kernel RDMA Use-After-Free in Path File Creation Cleanup

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64033

This vulnerability exists within the Linux kernel RDMA (Remote Direct Memory Access) sysfs path handling code. It is an internal kernel management function related to filesystem object cleanup during error paths. It is not exposed to the public internet or network-accessible in common deployments.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability involves a flaw in the Linux kernel's handling of remote direct memory access (RDMA) resource cleanup. If specific error conditions occur during the creation of path files, it could lead to a use-after-free issue, potentially impacting system stability and security. The main concern is confirming relevance and exposure, as this flaw resides within internal kernel functions.

A flaw exists in how the Linux kernel cleans up certain network resources.
Matters for system stability and security if network resource cleanup fails.
Confirm relevance and any potential exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a specific error condition during the creation of certain file system objects within the Linux kernel's RDMA subsystem. This error path, if hit, can lead to a use-after-free situation.

Requires triggering an error during file creation.
Vulnerability is in kernel sysfs path handling.
Allows arbitrary read/write and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system data related to RDMA path file creation cleanup within the Linux kernel. When specific error conditions occur during the creation of these files, a use-after-free flaw can be triggered. This could potentially lead to unintended system behavior or data corruption in systems utilizing these specific kernel functions.

Kernel path creation data could be affected.
A use-after-free may occur during error handling.
Unintended service behavior or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Linux kernel's RDMA subsystem requires immediate attention from teams managing Linux infrastructure and applications utilizing RDMA. The first practical step is to identify all systems running the affected kernel components, confirm their exposure and business criticality, and then coordinate remediation efforts with the system owners.

Infrastructure and platform teams own remediation.
Verify affected Linux systems and RDMA usage.
Plan updates during scheduled maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel RDMA subsystem?

The RDMA (Remote Direct Memory Access) subsystem in the Linux kernel enables high-speed, low-latency data movement between computer memories without involving the operating system's main processor. This technology is frequently used in high-performance computing clusters and enterprise data centers to improve network performance. The specific component involved here, rtrs, handles remote transport services for these connections.

What does use-after-free mean for CVE-2026-64033?

A use-after-free is a memory management flaw. In this case, the kernel attempts to use a specific data structure after it has already been deleted or 'freed' from memory. Because the kernel relies on these structures for tracking RDMA paths, accessing the invalid memory can lead to system instability or potentially allow an attacker to interfere with system operations.

How is this RDMA vulnerability triggered?

The flaw only occurs if a specific error happens during the creation of RDMA path files. It is not triggered by standard, successful operation. If the system fails to set up these files correctly, the kernel attempts to clean up resources in the wrong order, causing the use-after-free. If the setup process completes successfully or does not encounter this specific error path, the bug is not triggered.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is very unlikely to be reachable in most environments. The flaw exists within internal kernel management code for filesystem object cleanup. It is not directly exposed to the public internet or standard network traffic, meaning an attacker cannot reach this specific internal failure point through typical remote network requests.

How should I respond to CVE-2026-64033?

Start by identifying which of your Linux systems actively utilize RDMA services, as only these are potentially affected. Once identified, verify if those systems are running an affected kernel version. Coordinate with your infrastructure teams to track upstream kernel updates and plan for deployment during your standard maintenance windows to address the resource cleanup logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.