---
id: CVE-2026-89527
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  svcrdma: Use svc_xprt_put to free listener on create failure

  svc_rdma_create() calls kfree(cma_xprt) when
  svc_rdma_create_listen_id() fails
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  svcrdma: Use svc_xprt_put to free listener on create failure

  svc_rdma_create() calls kfree(cma_xprt) when
  svc_rdma_create_listen_id() fails. svc_xprt_init() has alread…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-772
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - openshift_container_platform 4
published: '2026-09-11'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:53.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89527'
references:
  - url: 'https://git.kernel.org/stable/c/ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e346ef7bcb137f50c49f969330ab7dcf64ea1654'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e68380710fc970e07610b2f42594575ad35fdb1c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee70d690b5544b736706a9a5796aafb634013f54'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89527.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89527'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532056'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89527'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89527'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89527.mbox
  - url: 'https://git.kernel.org/stable/c/2e35ec558b8cece9399a50141ecaeadbdb8768dc'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00217
epssPercentile: 0.12034
cvssSource: vendor
ingestedAt: '2026-09-14T11:11:19.886Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Use svc_xprt_put to free listener on create failure

svc_rdma_create() calls kfree(cma_xprt) when
svc_rdma_create_listen_id() fails. svc_xprt_init() has already
acquired a net namespace reference via get_net_track(); kfree
bypasses svc_xprt_free() which releases it.

Replace the kfree() with svc_xprt_put() so the kref_init birth
reference drops to zero and svc_xprt_free() dispatches
svc_rdma_free() to clean up properly. sc_cm_id is still NULL
at that point; the preceding patch added the necessary NULL
guard in svc_rdma_free().

svc_xprt_free() also drops the module reference via
module_put(), but the caller _svc_xprt_create() does the same
on xpo_create failure, double-putting the single
try_module_get() it acquired. Take a compensating
__module_get() before the svc_xprt_put() to keep the count
balanced, matching the convention in svc_rdma_accept()'s error
path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89527.json)