The Linux kernel's sunrpc subsystem had a flaw where svc_set_num_threads() could assign fewer threads than pools, resulting in some pools having zero threads. svc_xprt_enqueue() routes transports to pools based on CPU, but if a transport is assigned to a threadless pool, it remains enqueued and unserviced, causing indefinite connection hangs. The patch modifies svc_pool_for_cpu() to skip pools without threads and select the next available populated pool, ensuring work is serviced even if NUMA locality is compromised. The update to sp_nrthreads is protected by the service mutex, while the routing hint uses a best-effort lockless read annotated with data_race().

Affected Linux kernel configurations running sunrpc services with fewer threads than pools (e.g., nfsd with fewer threads than NUMA nodes in pernode or percpu mode) may experience indefinite connection hangs. This impacts service availability but does not indicate code execution or data corruption. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue. Users should update to the kernel version that includes this patch. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly confirmed in the provided data; verify with the vendor advisory for current remediation guidance.