Answer in brief
CVE-2023-54269 records a Critical severity (CVSS 9.8) vulnerability in SUNRPC: double free xprt_ctxt while still in use. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f5e13d700a4d40ccde3d36e383f9247dcb3c1d2d <7851771789e87108a92697194105ef0c9307dc5e || >=773f91b2cf3f52df0d7508fdbf60f37567cdaee4 <fd86534872f445f54dc01e7db001e25eadf063a8 || >=773f91b2cf3f52df0d7508fdbf60f37567cdaee4 <e0c648627322a4c7e018e5c7f837c3c03e297dbb || >=773f91b2cf3f52df0d7508fdbf60f37567cdaee4 <eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1 || 11fab500f86403b2ebf6795feeade6e10302e448 || >=5.15.35 <5.15.113 || >=5.17.4 <5.18 | 7851771789e87108a92697194105ef0c9307dc5e, fd86534872f445f54dc01e7db001e25eadf063a8, e0c648627322a4c7e018e5c7f837c3c03e297dbb, eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1, 5.15.113, 5.18 |
| Linux/Linuxgeneric | 5.18 | Not reported |
Published upstream
Dec 30, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - and also remains in the svc_deferred_req. In the (rare?) case that the request is deferred a second time, the old svc_deferred_req is reused - it still has all the correct content. However in that case the rq_xprt_ctxt pointer is NOT cleared so that when xpo_release_xprt is called, the ctxt is freed (UDP) or possible added to a free list (RDMA). When the deferred request is revisited for a second time, it will reference this ctxt which may be invalid, and the free the object a second time which is likely to oops. So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that the value is now stored in the svc_deferred_req.
Quoted source text, attributed separately from HOL analysis.