diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index ab71d094820506d1abf4f56a7fb09cf678fdf250..06c89a8b6d775b58277b0fb1f0c968c9bc53fac6 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -927,7 +927,11 @@ static int avc_update_node(struct selinux_avc *avc,
 		node->ae.avd.auditdeny &= ~perms;
 		break;
 	case AVC_CALLBACK_ADD_XPERMS:
-		avc_add_xperms_decision(node, xpd);
+		rc = avc_add_xperms_decision(node, xpd);
+		if (rc) {
+			avc_node_kill(avc, node);
+			goto out_unlock;
+		}
 		break;
 	}
 	avc_node_replace(avc, node, orig);