The vulnerability arises from a stack‑allocated structure, xprt_create_args, in the SunRPC subsystem of the Linux kernel. While several fields are populated, critical members such as srcaddr, bc_xps, and flags remain uninitialized, resulting in garbage values. When the transport setup code accesses these fields, it can dereference invalid addresses, produce a kernel panic, leak sensitive stack data, and cause unpredictable kernel behaviour. The impact is therefore a denial of service through kernel crash and a potential information disclosure.

All Linux kernel releases that include the SunRPC code before the commit 17d90b68c3a3d7d7e95b49e1fe9381a723f637a8 are affected. The fix resides in that commit, so any distribution shipping a kernel older than that commit is vulnerable. No additional vendor or product variations are specified beyond the generic Linux kernel.

The CVSS score is 5.5 and the EPSS score is less than 1%, indicating a moderate severity while the exploitation probability remains low. The flaw involves kernel space and can be triggered by malicious SunRPC traffic, which suggests a remote attack vector; local exploitation may also be possible if an attacker can influence RPC input. Because a kernel panic disables the system, the risk warrants high priority. The vulnerability is not listed in the CISA KEV catalog.