A race condition exists in the Linux kernel SUNRPC TLS handshake handling. xs_tls_handshake_sync() gives xs lower transport before submitting the handshake request. On timeout or signal, the waiter drops that reference after calling tls_handshake_cancel(). handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. If the completion callback is still executing, the waiter’s drop can free the lower transport while the callback later references or stores data. This timing flaw can release memory that is still in use, leading to a use-after-free, memory panic that terminates the process handling the RPC, resulting in a denial of service.

This flaw affects the Linux kernel’s SUNRPC implementation; specific vendor and product details are listed as Linux Linux. No particular kernel versions are named in the provided data, so all versions before the commit that introduced the fix are considered vulnerable.

The CVSS score of 5.3 reflects moderate severity. The EPSS score of less than 1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to trigger a cancellation or timeout event during an RPC session, which may be difficult in practice, but could result in a kernel crash or denial of service if successful. The flaw remains unpatched in older kernel releases.