diff --git a/net/socket.c b/net/socket.c
index 639d76f20384e62845cdb0387982b996a40c57d0..bd438b89e698e82c4c2eaba3ab75c440d4c8d7c0 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1548,8 +1548,13 @@ int __sock_create(struct net *net, int family, int type, int protocol,
 	rcu_read_unlock();
 
 	err = pf->create(net, sock, protocol, kern);
-	if (err < 0)
+	if (err < 0) {
+		/* ->create should release the allocated sock->sk object on error
+		 * but it may leave the dangling pointer
+		 */
+		sock->sk = NULL;
 		goto out_module_put;
+	}
 
 	/*
 	 * Now to bump the refcnt of the [loadable] module that owns this