CVE-2026-89527: svcrdma: Use svc_xprt_put to free listener on create failure
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Use svcxprtput to free listener on create failure
svcrdmacreate() calls kfree(cmaxprt) when svcrdmacreatelistenid() fails. svcxprtinit() has already acquired a net namespace reference via getnettrack(); kfree bypasses svcxprtfree() which releases it.
Replace the kfree() with svcxprtput() so the krefinit birth reference drops to zero and svcxprtfree() dispatches svcrdmafree() to clean up properly. sccmid is still NULL at that point; the preceding patch added the necessary NULL guard in svcrdmafree().
svcxprtfree() also drops the module reference via moduleput(), but the caller svcxprtcreate() does the same on xpocreate failure, double-putting the single trymoduleget() it acquired. Take a compensating moduleget() before the svcxprtput() to keep the count balanced, matching the convention in svcrdmaaccept()'s error path.
Event History
Frequently Asked Questions
When does the affected error path run?
It runs when svc_rdma_create_listen_id() fails during svc_rdma_create(). At that point, the listener's sc_cm_id is still NULL.
What cleanup is missed on this path?
Freeing the listener directly bypasses svc_xprt_free(), leaving the net namespace reference acquired by svc_xprt_init() unreleased. The corrected path also balances module references so the caller's failure cleanup does not double-put the module reference.