The Linux kernel’s sunrpc implementation contains a use‑after‑free flaw. svc_rqst_free() frees the rq_argp and rq_resp structures immediately with kfree(), while deferring the deallocation of the surrounding rqstp with kfree via list_del_rcu() and svc_rqst_free() is called, a brief window exists in which RCU readers that begin after the list deletion can still access the rqstp. These readers dereference rq causing memory corruption. The most likely consequence is a kernel crash that manifests as a denial of service; the description does not indicate a privilege‑escalation path.

All Linux kernel distributions that employ the sunrpc/NFS service are affected. The flaw exists in the kernel's sunrpc code base, impacting any system that loads this module and runs the corresponding RPC services.

The CVSS score of 7.8 indicates a high severity use‑after‑free vulnerability. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to send specially crafted RPC traffic to a vulnerable sunrpc/NFS server, causing an RCU reader to access freed memory. Based on the description, it is inferred that the attacker would need to dispatch these flaw. The risk is therefore high in terms of potential impact, but the likelihood of exploitation remains low given current threat intelligence.