The Linux kernel's SUNRPC subsystem had a vulnerability where __svc_create() initialized three per-pool percpu_counter stats but ignored their allocation return values. On SMP systems, if percpu_counter_init() failed due to __alloc_percpu_gfp() allocation failure, the counter's internal pointers remained NULL and associated locks and counts were uninitialized. Despite this, __svc_create() returned a partially constructed svc_serv object to services like nfsd or lockd. Subsequent hot-path increments accessed a NULL backing pointer, which did not fault but corrupted unrelated per-CPU memory or caused kernel lock debugging failures. This flaw can only be triggered locally by an administrator under memory pressure or fault injection during RPC server startup. The patch ensures each percpu_counter_init() return is checked, failing the service creation on allocation failure and properly destroying any partially initialized counters.

The vulnerability can cause silent corruption of per-CPU memory or kernel lock errors, potentially destabilizing the kernel or causing incorrect behavior in RPC services such as nfsd or lockd. Exploitation requires local administrator privileges and specific memory pressure conditions, so remote exploitation is not possible. There are no known exploits in the wild.

A fix has been implemented that checks the return values of percpu_counter_init() in __svc_create() and properly unwinds partially initialized counters on failure. Systems should apply the official kernel patch once available. Until then, the issue can only be triggered locally under memory pressure, limiting exposure.