The vulnerability in the Linux kernel's SUNRPC component arises from a race condition during the teardown of the NFS callback service. Specifically, backchannel receive operations can complete requests while the callback service is being torn down, causing requests to be enqueued or leaked improperly. The function xprt_enqueue_bc_request() may return without enqueueing or freeing a committed request if the callback service pointer has been cleared, leading to leaked references and potential use-after-free scenarios. The patch introduces xprt_svc_shutdown_bc() to clear the callback service pointer under lock before stopping callback threads, ensuring proper request handling and resource cleanup.

The vulnerability can lead to resource leaks and use-after-free conditions within the Linux kernel's SUNRPC subsystem during NFS callback service teardown. This could potentially cause kernel instability or crashes. No specific exploitation details or active exploits are reported.

A fix has been implemented in the Linux kernel to address this vulnerability by properly closing the producer side before stopping callback threads and ensuring all requests are correctly freed before service destruction. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.