{"id":"CVE-2026-89527","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Use svc_xprt_put to free listener on create failure\n\nsvc_rdma_create() calls kfree(cma_xprt) when\nsvc_rdma_create_listen_id() fails","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Use svc_xprt_put to free listener on create failure\n\nsvc_rdma_create() calls kfree(cma_xprt) when\nsvc_rdma_create_listen_id() fails. svc_xprt_init() has alread…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-772"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-09-11","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:53.850","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89527","references":[{"url":"https://git.kernel.org/stable/c/ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e346ef7bcb137f50c49f969330ab7dcf64ea1654","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e68380710fc970e07610b2f42594575ad35fdb1c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee70d690b5544b736706a9a5796aafb634013f54","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89527.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89527"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532056"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89527"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89527"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89527.mbox"},{"url":"https://git.kernel.org/stable/c/2e35ec558b8cece9399a50141ecaeadbdb8768dc"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00217,"epssPercentile":0.12034,"cvssSource":"vendor","ingestedAt":"2026-09-14T11:11:19.886Z","slug":"CVE-2026-89527","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Use svc_xprt_put to free listener on create failure\n\nsvc_rdma_create() calls kfree(cma_xprt) when\nsvc_rdma_create_listen_id() fails. svc_xprt_init() has already\nacquired a net namespace reference via get_net_track(); kfree\nbypasses svc_xprt_free() which releases it.\n\nReplace the kfree() with svc_xprt_put() so the kref_init birth\nreference drops to zero and svc_xprt_free() dispatches\nsvc_rdma_free() to clean up properly. sc_cm_id is still NULL\nat that point; the preceding patch added the necessary NULL\nguard in svc_rdma_free().\n\nsvc_xprt_free() also drops the module reference via\nmodule_put(), but the caller _svc_xprt_create() does the same\non xpo_create failure, double-putting the single\ntry_module_get() it acquired. Take a compensating\n__module_get() before the svc_xprt_put() to keep the count\nbalanced, matching the convention in svc_rdma_accept()'s error\npath.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89527.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":204203,"id":"CVE-2026-89527","ts":1789490240153,"field":"cvss","old":null,"new":"5.5"},{"seq":204202,"id":"CVE-2026-89527","ts":1789490240153,"field":"severity","old":"none","new":"medium"},{"seq":147804,"id":"CVE-2026-89527","ts":1789270212355,"field":"cvss","old":null,"new":"5.9"},{"seq":147803,"id":"CVE-2026-89527","ts":1789270212355,"field":"severity","old":"none","new":"medium"},{"seq":109554,"id":"CVE-2026-89527","ts":1789183732393,"field":"cvss","old":null,"new":"5.9"},{"seq":109553,"id":"CVE-2026-89527","ts":1789183732393,"field":"severity","old":"none","new":"medium"}]}