The Linux kernel’s sunrpc subsystem contains a use‑after‑free flaw in the __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir functions. After a late pipefs mount, remount, or unmount, the clnt->pipefs_sb pointer may remain stale while the rpc_clnt structure it points to has already been freed. Subsequent RPC information operations that reference the stale pointer can dereference the freed memory, potentially corrupting kernel memory.

All Linux kernel installations that include the sunrpc component and have not incorporated the patch from commit 932a8cf6abb2b2f8677b79153a823108d8861fe2. This includes every kernel version built prior to the application of that commit, irrespective of the numeric version, because the vulnerable code path exists in the base source.

The CVSS score of 4.1 reflects moderate severity. Exploitation requires manipulating pipefs mount operations or generating RPC traffic that triggers the stale pointer condition, which generally needs either local root‑privileged access or remote access to an enabled RPC service. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Although the official description does not confirm arbitrary code execution, the use‑after‑free could result in kernel memory corruption that, in the right circumstances, might lead to privilege escalation. However, such outcomes are not documented in the advisory.