{"id":"CVE-2026-89527","state":"PUBLISHED","title":"svcrdma: Use svc_xprt_put to free listener on create failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Use svc_xprt_put to free listener on create failure\n\nsvc_rdma_create() calls kfree(cma_xprt) when\nsvc_rdma_create_listen_id() fails. svc_xprt_init() has already\nacquired a net namespace reference via get_net_track(); kfree\nbypasses svc_xprt_free() which releases it.\n\nReplace the kfree() with svc_xprt_put() so the kref_init birth\nreference drops to zero and svc_xprt_free() dispatches\nsvc_rdma_free() to clean up properly. sc_cm_id is still NULL\nat that point; the preceding patch added the necessary NULL\nguard in svc_rdma_free().\n\nsvc_xprt_free() also drops the module reference via\nmodule_put(), but the caller _svc_xprt_create() does the same\non xpo_create failure, double-putting the single\ntry_module_get() it acquired. Take a compensating\n__module_get() before the svc_xprt_put() to keep the count\nbalanced, matching the convention in svc_rdma_accept()'s error\npath.","publishedAt":"2026-09-11T19:44:07.785Z","updatedAt":"2026-10-30T12:31:59.254Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"31b8293495ba94ccf494e556a318886b716884b6","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"2e35ec558b8cece9399a50141ecaeadbdb8768dc","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"ee70d690b5544b736706a9a5796aafb634013f54","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"e68380710fc970e07610b2f42594575ad35fdb1c","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"e346ef7bcb137f50c49f969330ab7dcf64ea1654","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/svc_rdma_transport.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.37","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/svc_rdma_transport.c"]}],"references":["https://git.kernel.org/stable/c/31b8293495ba94ccf494e556a318886b716884b6","https://git.kernel.org/stable/c/2e35ec558b8cece9399a50141ecaeadbdb8768dc","https://git.kernel.org/stable/c/ee70d690b5544b736706a9a5796aafb634013f54","https://git.kernel.org/stable/c/e68380710fc970e07610b2f42594575ad35fdb1c","https://git.kernel.org/stable/c/ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6","https://git.kernel.org/stable/c/e346ef7bcb137f50c49f969330ab7dcf64ea1654"],"weaknesses":[],"ingestedAt":"2026-10-30T12:50:04.827Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89527.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89527","state":"PUBLISHED","datePublished":"2026-09-11T19:44:07.785Z","dateUpdated":"2026-10-30T12:31:59.254Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.719Z"},"containers":{"cna":{"title":"svcrdma: Use svc_xprt_put to free listener on create failure","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Use svc_xprt_put to free listener on create failure\n\nsvc_rdma_create() calls kfree(cma_xprt) when\nsvc_rdma_create_listen_id() fails. svc_xprt_init() has already\nacquired a net namespace reference via get_net_track(); kfree\nbypasses svc_xprt_free() which releases it.\n\nReplace the kfree() with svc_xprt_put() so the kref_init birth\nreference drops to zero and svc_xprt_free() dispatches\nsvc_rdma_free() to clean up properly. sc_cm_id is still NULL\nat that point; the preceding patch added the necessary NULL\nguard in svc_rdma_free().\n\nsvc_xprt_free() also drops the module reference via\nmodule_put(), but the caller _svc_xprt_create() does the same\non xpo_create failure, double-putting the single\ntry_module_get() it acquired. Take a compensating\n__module_get() before the svc_xprt_put() to keep the count\nbalanced, matching the convention in svc_rdma_accept()'s error\npath."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"31b8293495ba94ccf494e556a318886b716884b6","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"2e35ec558b8cece9399a50141ecaeadbdb8768dc","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"ee70d690b5544b736706a9a5796aafb634013f54","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"e68380710fc970e07610b2f42594575ad35fdb1c","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6","versionType":"git"},{"version":"4fb8518bdac8e85f6580ea3f586adf396cd472bc","status":"affected","lessThan":"e346ef7bcb137f50c49f969330ab7dcf64ea1654","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/svc_rdma_transport.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.37","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.56","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sunrpc/xprtrdma/svc_rdma_transport.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/31b8293495ba94ccf494e556a318886b716884b6"},{"url":"https://git.kernel.org/stable/c/2e35ec558b8cece9399a50141ecaeadbdb8768dc"},{"url":"https://git.kernel.org/stable/c/ee70d690b5544b736706a9a5796aafb634013f54"},{"url":"https://git.kernel.org/stable/c/e68380710fc970e07610b2f42594575ad35fdb1c"},{"url":"https://git.kernel.org/stable/c/ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6"},{"url":"https://git.kernel.org/stable/c/e346ef7bcb137f50c49f969330ab7dcf64ea1654"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:31:59.254Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"6.18.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}