The SUNRPC handles multiple CREDS_VALUE options sent in a single RPC reply. Each repeated option causes the kernel to reinstall the group information structure without freeing the previous allocation, resulting in a memory leak. Over time the leaked kernel memory to a system-wide denial of service. The flaw does not directly expose data or alter kernel integrity; its impact is confined to resource depletion.

All releases of the Linux kernel that have not integrated the commit series referenced in the advisory are affected. The vendor identified is Linux, and the vulnerability applies to the kernel itself. Any Debian, Ubuntu, Red‑Hat, CentOS, or other distributions running affected kernel versions that have not applied the patch repositories are at risk until they upgrade to a kernel containing the fix.

The vulnerability is exploitable by delivering crafted RPC replies that include duplicate CREDS_VALUE options, which requires the attacker to control or influence traffic to the kernel’s SUNRPC service. The likely attack vector is remote exploitation of the GSS‑based SUNRPC authentication mechanism, but a local attacker with the ability to inject such replies could also trigger the leak. EPSS indicates an exploitation probability of less than 1%, and the issue is not listed in the CISA KEV catalog, suggesting it is not actively targeted. Nonetheless, any successful exploitation results in memory exhaustion and potential denial of service on the affected node.