The kernel function responsible for initializing service pools neglected to check the return status of per‑CPU counter allocation. When an allocation failed, the counter pointer remained NULL, yet the partially constructed service was accepted by the NFS subsystem. Subsequent use of the counter in hot‑path operations silently accessed the per‑CPU region at offset zero, corrupting arbitrary data and potentially causing kernel instability. This flaw leads to system compromise and could be leveraged by an attacker.

All Linux kernel releases that include the vulnerable svc_create implementation are affected; the exact version ranges are not specified, but any kernel missing the patch that checks percpu_counter_init return values is vulnerable. The flaw resides in NFS, lockd, and the NFS callback service components of the kernel.

The CVSS score of 4.7 indicates a moderate impact, and the EPSS score is < 1% indicating a very low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog. It requires a local administrator to trigger the vulnerable state by stressing memory or injecting faults during RPC server startup; a remote peer cannot induce the bug. Once triggered, the corruption may cause denial of service or further compromise if the attacker can manipulate the corrupted data. Overall, the risk is moderate with a local attack vector.