The Linux kernel svcrdma subsystem had a flaw in svc_rdma_create() where on failure of svc_rdma_create_listen_id(), it called kfree(cma_xprt) directly. This bypassed svc_xprt_free(), which is responsible for releasing a net namespace reference acquired earlier and properly cleaning up resources. The patch replaces kfree() with svc_xprt_put(), allowing the reference count to drop to zero and triggering svc_xprt_free() to call svc_rdma_free() for proper cleanup. Additionally, to avoid double decrementing the module reference count, a compensating __module_get() is added before svc_xprt_put(), balancing the reference count management according to the convention in related error paths.

Improper cleanup of kernel resources on failure paths could lead to resource leaks or inconsistent reference counting, potentially causing stability or reliability issues in the kernel's RDMA service. No known exploits in the wild have been reported. The impact is limited to kernel resource management correctness rather than direct code execution or privilege escalation.

A fix has been implemented in the Linux kernel source code to address this issue by replacing kfree() with svc_xprt_put() and adjusting module reference counting. Users should apply the official kernel updates containing this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing list advisories for the exact fixed versions and update instructions.