The vulnerability in the Linux kernel's SUNRPC component involved the function sunrpc_destroy_cache_detail() which only canceled the global cache_cleaner delayed_work if the cache_list was empty. During per-network namespace teardown, the cache_list remained non-empty due to init_net's caches, preventing cancellation. Consequently, cache_destroy_net() freed the cache_detail while cache_clean() could still access it, causing a use-after-free. Specifically, cache_dequeue() accessed a lock on freed memory and cache_put() dereferenced a function pointer from freed slab memory. The fix removes the list_empty condition so that cancel_delayed_work_sync() always runs, ensuring any in-flight cache_clean() completes before freeing cache_detail, and re-arms the cleaner if other caches remain registered.

This vulnerability results in a use-after-free condition in the Linux kernel's SUNRPC subsystem, which can lead to kernel memory corruption. Such corruption may cause system instability or crashes. No information is provided about active exploitation in the wild or privilege escalation impact.

No explicit vendor advisory or patch link is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves modifying sunrpc_destroy_cache_detail() to always cancel the cache_cleaner delayed work before freeing cache_detail, preventing use-after-free.