UBUNTU-CVE-2026-89527: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate() calls kfree(cmaxprt) when svcrdmacreatelistenid() fails. svcxprtinit() has already acquired a net namespace reference via getnettrack(); kfree bypasses svcxprtfree() which releases it. Replace the kfree() with svcxprtput() so the krefinit birth reference drops to zero and svcxprtfree() dispatches svcrdmafree() to clean up properly. sccmid is still NULL at that point; the preceding patch added the necessary NULL guard in svcrdmafree(). svcxprtfree() also drops the module reference via moduleput(), but the caller svcxprtcreate() does the same on xpocreate failure, double-putting the single trymoduleget() it acquired. Take a compensating moduleget() before the svcxprtput() to keep the count balanced, matching the convention in svcrdmaaccept()'s error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In svc_rdma_create(), replace kfree(cma_xprt) with svc_xprt_put() when svc_rdma_create_listen_id() fails, and take a compensating __module_get() before svc_xprt_put() to keep the module reference count balanced.