The vulnerability arises from an out‑of‑bounds write in the SUNRPC helper function xdr_buf_to_bvec(). The function stores a bio_vec element before checking array bounds, so a carefully crafted RPC request can write beyond the end of the buffer. The overwritten fields are part of adjacent slab structures and contain lengths and offsets derived from client data. In kernel space, such corruption can lead to arbitrary code execution or a crash, effectively allowing an attacker to gain privileges or disrupt service. Identified as a bounds‑check failure.

All Linux kernel releases that include the old implementation of SUNRPC, i.e., kernel versions prior to the security commit that introduced the in‑range check. The flaw sits in the generic kernel code used by NFS server (nfsd) and RPC services. Any system running the kernel before the patch is potentially vulnerable.

The flaw is exercised via the network by sending malicious RPC traffic to an exposed SUNRPC/NFS service. The attack can be performed remotely and does not require local privileges. The EPSS score of < 1% indicates a very low probability of exploitation in the wild, but the vulnerability is not present in the CISA KEV list, and the kernel crash or escalation potential is significant. The CVSS score of 9.8 highlights a high severity. Because the patch simply moves a bounds check, the exploit path is straightforward once a suitable RPC payload can reach the victim. Until a kernel update is applied, containment through firewall rules blocking unwanted RPC access or enforcing SELinux/AppArmor profiles can reduce risk.