The Linux kernel’s sunrpc implementation contains a use‑after‑free flaw. svc_rqst_free() frees the rq_argp and rq_resp structures immediately with kfree(), while deferring the deallocation of the surrounding rqstp with kfree_rcu(). After a thread list element is removed via list_del_rcu() and svc_rqst_free() is called, a brief window exists in which RCU readers that begin after the list deletion can still access the rqstp. These readers dereference rq_argp, which has already been freed, causing memory corruption. The most likely consequence is a kernel crash that manifests as a denial of service; the description does not indicate a privilege‑escalation path.

All Linux kernel distributions that employ the sunrpc/NFS service are affected. The flaw exists in the kernel's sunrpc code base, impacting any system that loads this module and runs the corresponding RPC services.

The CVSS score of 6.6 reflects a moderately severe use‑after‑free vulnerability. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to send specially crafted RPC traffic to a vulnerable sunrpc/NFS server, causing an RCU reader to access freed memory. The risk is therefore moderate in terms of potential impact, but the likelihood of exploitation remains low given current threat intelligence.