CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Use svc xprt put to free listener on create failure

svc rdma create() calls kfree(cma xprt) when svc rdma create listen id() fails. svc xprt init() has already acquired a net namespace reference via get net track(); kfree bypasses svc xprt free() which releases it.

Replace the kfree() with svc xprt put() so the kref init birth reference drops to zero and svc xprt free() dispatches svc rdma free() to clean up properly. sc cm id is still NULL at that point; the preceding patch added the necessary NULL guard in svc rdma free().

svc xprt free() also drops the module reference via module put(), but the caller svc xprt create() does the same on xpo create failure, double-putting the single try module get() it acquired. Take a compensating module get() before the svc xprt put() to keep the count balanced, matching the convention in svc rdma accept()'s error path.