The vulnerability in the Linux kernel sunrpc xprtsock subsystem stems from the use of plain stores and loads when replacing and restoring shared socket callback pointers (sk->sk_data_ready and sk->sk_write_space). These pointers are shared with generic socket and protocol paths that may concurrently read or invoke them, leading to a visibility hole where a stale snapshot of the callback pointers can be invoked after restoration. The fix applies WRITE_ONCE() to stores and READ_ONCE() to loads of these callback pointers in relevant functions (xs_local_finish_connecting(), xs_udp_finish_connecting(), xs_tcp_finish_connecting(), xs_restore_old_callbacks(), and xs_udp_do_set_buffer_size()), enforcing the required memory visibility contract and preventing stale callback invocation.

This vulnerability can lead to use of stale callback pointers on live sockets, potentially causing incorrect callback invocation, which may result in data corruption, denial of service, or other critical impacts affecting confidentiality, integrity, and availability of the system. The CVSS score of 9.8 reflects the high severity and network attack vector with no privileges or user interaction required.

A fix for this vulnerability has been implemented by annotating the shared socket callback pointers with READ_ONCE() and WRITE_ONCE() to ensure proper memory visibility and ordering. Users should apply the official Linux kernel patch that includes these changes. No additional mitigation steps are indicated beyond applying the patch.