The vulnerability in the Linux kernel's sunrpc component involved the svc_release_rqst() function executing a callback via rq_procinfo->pc_release. If a worker thread processing a new RPC request encountered an early error before a valid rq_procinfo was set, a stale release hook from a previous RPC could be re-triggered. This caused a double-free or use-after-free condition. The fix hardened rq_procinfo lifecycle by clearing rq_procinfo after the release callback, explicitly clearing it at request entry in svc_process(), and similarly in svc_process_bc() for backchannel requests, preventing error flows from encountering stale pointers.

This vulnerability could lead to memory corruption in the Linux kernel's sunrpc subsystem, potentially causing system instability or crashes. No information about active exploitation in the wild is available.

A fix has been implemented in the Linux kernel to harden the rq_procinfo lifecycle and prevent double-free or use-after-free conditions. Users should apply the official kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update guidance.