The vulnerability lies within the kernel’s SUNRPC subsystem, where the decoding routine svcauth_gss_decode_credbody fails to clear the rpc_gss_wire_cred structure on early return, leaving stale credential data and length values. This results in a dangling pointer paired with an old length that can be accessed by subsequent functions such as gss_svc_searchbyctx. The flaw is an example of uncontrolled memory write (CWE-825). A malicious GSS authentication packet can trigger this path, causing the kernel to dereference invalid memory and potentially leading to arbitrary code execution or a kernel panic.

Linux kernel releases that have not incorporated the patch that zeroes rpc_gss_wire_cred at function entry are affected. The fix is documented in commit 0e18641708eaa8bc3c1ff338cd844aeadbd52bac and subsequent series. Systems running RPC services that use GSS authentication, such as NFS, mountd, or other SunRPC‑based services exposed to external networks, are at risk.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of <1% suggests a very low but non‑zero probability of exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is remote: an adversary that can send crafted RPC requests to the vulnerable service can trigger the faulty decoding path, potentially achieving arbitrary code execution or a denial‑of‑service condition.