In the Linux kernel RDMA/rtrs subsystem, a use‑after‑free occurs during rtrs_srv_create_path_files when an error path causes a kobject_put before the sysfs root folders are destroyed. The kobject release frees the srv_path struct while later cleanup logic still accesses it, resulting in a memory corruption that can lead to arbitrary kernel code execution. This flaw is identified as CWE‑825 and based on the description, it is inferred that a local attacker could corrupt critical kernel data, potentially achieving privilege escalation at the ring‑0 level.

The affected product is the Linux kernel, specifically any release that contains the unpatched RDMA/rtrs implementation. Distributions that ship a kernel before the commit that moves sysfs cleanup ahead of the kobject release are vulnerable. The CNA vendor is Linux, and no specific version numbers are provided in this CVE record, so administrators should check whether their running kernel includes the vulnerable code path.

The CVSS score of 9.8 indicates a critical severity. The EPSS score is < 1%, showing a low probability of exploitation at the time of this analysis. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that exploiting this flaw would require local access to trigger the error path in the RDMA subsystem and could grant full kernel privileges. Consequently, the risk is high for any system that has not applied the patch.