CVE-2026-89527

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Use svc_xprt_put to free listener on create failure

svc_rdma_create() calls kfree(cma_xprt) when

svc_rdma_create_listen_id() fails. svc_xprt_init() has already

acquired a net namespace reference via get_net_track(); kfree

bypasses svc_xprt_free() which releases it.

Replace the kfree() with svc_xprt_put() so the kref_init birth

reference drops to zero and svc_xprt_free() dispatches

svc_rdma_free() to clean up properly. sc_cm_id is still NULL

at that point; the preceding patch added the necessary NULL

guard in svc_rdma_free().

svc_xprt_free() also drops the module reference via

module_put(), but the caller _svc_xprt_create() does the same

on xpo_create failure, double-putting the single

try_module_get() it acquired. Take a compensating

__module_get() before the svc_xprt_put() to keep the count

balanced, matching the convention in svc_rdma_accept()'s error

path.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References