The vulnerability arises from a race condition where Sun RPC service threads are unevenly distributed across CPU pools. When a service is configured with fewer threads than pools, some pools remain empty. The dispatch routine svc_xprt_enqueue selects a pool based on the CPU of the incoming request, queues the transport, and only wakes a thread from the same pool. If that pool has no worker threads, the transport stays queued indefinitely, causing the client connection to hang with no progress. The flaw is a classic concurrent programming race that results in a form of resource starvation (CWE-362).

Affected systems are Linux kernel installations that enable the Sun RPC NFS server with NUMA‑aware thread allocation in pernode or percpu mode where the number of configured threads is less than the number of CPU pools. The report does not list specific kernel versions, so any kernel where svc_pool_for_cpu has not been patched for this issue is potentially affected.

The vulnerability carries a CVSS score of 5.9 and an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. The flaw only causes the RPC service to hang without providing code execution or privilege escalation, so exploitation is driven by the ability to send many requests to a vulnerable server. The likely attack vector is a client‑initiated network request to the RPC service, such as an NFS mount or RPC call. If the kernel has not been patched to skip empty pools, an attacker could trigger stalled connections and ultimately degrade service availability.