The vulnerability in the Linux kernel's SUNRPC TLS handshake code arises from xs_tls_handshake_sync() giving xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel(). If handshake_req_cancel() returns false because the handshake is already complete, the completion callback may still be running, and dropping the callback-owned reference in the waiter can free the lower transport prematurely before xs_tls_handshake_done() stores error information or drops its own reference. The fix waits for xs_tls_handshake_done() to signal handshake_done before releasing the reference, mirroring server-side handling and preserving the return value semantics.

The vulnerability could lead to premature freeing of the lower transport object during the TLS handshake process in SUNRPC clients, potentially causing use-after-free conditions. This may result in kernel instability or crashes. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to properly manage reference counting during the SUNRPC client TLS handshake. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.