The Linux kernel’s sunrpc module may invoke an obsolete cleanup routine after an early error in a request, leading to a double‑free or use‑after‑free. This memory corruption can enable an attacker to achieve kernel‑level privilege escalation or denial of service.

All Linux kernel releases that include the sunrpc module before the inclusion of the hardening changes are impacted. No specific version numbers are listed, so any kernel prior to the patch remains vulnerable.

The CVSS score of 9.8 classifies the flaw as critical. The EPSS score of < 1% indicates a low probability of exploitation, but the privileged context of the kernel makes the impact severe. The flaw is not listed in the CISA KEV catalog, but the high severity still warrants priority remediation. The likely attack vector is remote via a crafted RPC payload, inferred from the description of early error paths in svc_release_rqst() and svc_process().