The vulnerability is a use‑after‑free in the SUNRPC cache cleanup routine of the Linux kernel. When a cache_detail object is freed while a background cache_cleaner thread may still reference it, a freed pointer is accessed, causing memory corruption and potentially arbitrary kernel code execution. This flaw corresponds to CWE‑825.

The affected product is the Linux kernel, specifically the SUNRPC module that manages per‑net namespace transmission caches. No explicit kernel version range is listed, but the patch commit references the usual branch of unpatched kernel that loads the SUNRPC module and receives RPC traffic is potentially exposed.

The CVSS score is 7.8 and the EPSS score is less than 1%, indicating a high severity but low exploitation probability. The use‑after‑free in the kernel can be leveraged by an attacker controlling SUNRPC traffic, potentially enabling privilege escalation or remote code execution. The vulnerability is not listed in CISA KEV, suggesting it is new and not yet widely exploited. The likely attack vector is remote over the network through crafted SUNRPC requests, as the flaw arises during per‑net‑namespace teardown triggered by network activity.