The vulnerability in the Linux kernel RDMA/rtrs subsystem involves a use-after-free condition triggered in the error handling path of rtrs_srv_create_path_files(). Specifically, if an error occurs after sysfs root folders and the kobject srv_path->kobj have been partially initialized, the cleanup sequence incorrectly calls kobject_put(&srv_path->kobj) before destroying the sysfs root folders. This can cause srv_path to be freed prematurely via the release callback, leading to a use-after-free when rtrs_srv_destroy_once_sysfs_root_folders(srv_path) subsequently accesses srv_path. The issue was fixed by changing the cleanup order to destroy sysfs root folders before calling kobject_put(), preventing access to freed memory.

This use-after-free vulnerability could lead to kernel memory corruption or instability if triggered. However, it occurs only in an error path during path file creation cleanup in the RDMA/rtrs kernel component. There are no known exploits in the wild. The impact is limited to affected Linux kernel versions containing this code path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by reordering cleanup calls in the affected function. Users should monitor official Linux kernel advisories and apply updates when available to remediate this issue.