The vulnerability in the Linux kernel sunrpc subsystem involves a use-after-free condition in the functions __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir. Normal client creation sets clnt->pipefs_sb correctly, but the mount-event path bypasses refreshing this field. The unmount path removes the directory without clearing clnt->pipefs_sb. After a late pipefs mount or remount, the stale pipefs_sb pointer causes rpc_clnt_remove_pipedir to skip cleanup, leaving dentries with inode private data pointing to freed rpc_clnt structures. This can lead to use-after-free during rpc_info_open() or rpc_show_info() calls. The fix updates clnt->pipefs_sb properly on mount events and clears it during unmount or failure paths.

The vulnerability can cause use-after-free conditions in the Linux kernel's sunrpc subsystem, potentially leading to kernel memory corruption or crashes when certain RPC info functions are called. No specific exploitation details or in-the-wild exploits are reported.

A fix has been implemented in the Linux kernel to properly update and clear the clnt->pipefs_sb pointer during mount and unmount events. Users should apply the official kernel updates that include this fix. No additional mitigation steps are indicated.