In the Linux kernel the rpcb_register_inet4/6 functions omit a null‑check on the return value of rpc_sockaddr2uaddr(). When the helper fails to allocate memory, it returns NULL; this null pointer is later dereferenced in the RPCBPROC_SET encode routine. The kernel then oops, causing a general protection fault and a reboot. The failure can be triggered by running an in‑kernel RPC service such as nfsd, lockd, or nfs‑callback under memory pressure, which makes the small GFP_KERNEL kstrdup() fail.

All Linux kernel implementations that contain the vulnerable rpcb_register_inet4/6 code are affected. The issue was reproduced on kernel v6.12 in the failslab test harness; any kernel version that uses the same code path is potentially impacted. The vulnerability is present in the generic Linux kernel, not tied to a specific vendor distribution.

The vulnerability causes a local denial of service through a kernel panic; no arbitrary code execution or remote privilege escalation is documented. Exploitation requires the attacker to cause the kernel to register an RPC endpoint while memory allocation fails, meaning the attack vector is local or via a component that can trigger memory pressure on the target. EPSS data is not available and the vulnerability is not listed in CISA KEV, indicating a lower public exposure, but the impact of a kernel crash remains severe. The risk is heightened on systems with high NFS load or limited memory, as they are more likely to reach the allocation failure state.