diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 726f944bd798eae34a185da0833654380700a0de..bea7d207ed43b105aedcb86506dfba2d497a498a 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -938,7 +938,11 @@ static int avc_update_node(struct selinux_avc *avc,
 		node->ae.avd.auditdeny &= ~perms;
 		break;
 	case AVC_CALLBACK_ADD_XPERMS:
-		avc_add_xperms_decision(node, xpd);
+		rc = avc_add_xperms_decision(node, xpd);
+		if (rc) {
+			avc_node_kill(avc, node);
+			goto out_unlock;
+		}
 		break;
 	}
 	avc_node_replace(avc, node, orig);