CVE-2023-54269: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54269 is a double-free vulnerability in the Linux kernel's SUNRPC subsystem, specifically in the svc_defer() function handling deferred RPC requests. When an RPC request is deferred a second time, the rq_xprt_ctxt pointer is not cleared, causing the transport context to be freed (for UDP) or added to a free list (for RDMA) while still referenced, and then freed again when the deferred request is revisited — likely resulting in a kernel oops. The vulnerability affects Linux kernel versions from 5.18 up to the patched releases (5.15.113, 6.1.30, 6.3.4, and 6.4). It was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000180 (Feedly, EUVD).

The root cause is a double-free memory error (CWE-415) in the Linux kernel's SUNRPC server-side request deferral logic. When svc_defer() is called, the rq_xprt_ctxt pointer is moved from svc_rqst into svc_deferred_req; however, when the deferred request is revisited and deferred a second time, the old svc_deferred_req is reused without clearing rq_xprt_ctxt in the new svc_rqst. This causes xpo_release_xprt to free or recycle the context object while it is still referenced by the deferred request structure, and the object is freed a second time upon the second revisit. The fix modifies svc_defer() to always clear rq_xprt_ctxt and assert that the value is stored in svc_deferred_req (Feedly, EUVD).

Successful exploitation of this vulnerability can cause a kernel panic (oops) due to the double-free of a transport context object, resulting in a denial of service of the affected system. The impact is primarily an availability concern, as the double-free corrupts kernel memory and can crash the host. Systems running NFS servers or other SUNRPC-based services over UDP or RDMA are most at risk, particularly in scenarios where RPC requests are deferred multiple times — a rare but possible condition (Feedly, EUVD).

The Linux kernel project has released patches addressing this vulnerability in stable branches: versions 5.15.113, 6.1.30, 6.3.4, and 6.4 contain the fix. Administrators should update their Linux kernel to one of these patched versions or later. The fix is available via the upstream stable kernel commits 7851771789e8, fd86534872f4, e0c648627322, and eb8d3a2c809a (EUVD). As a temporary workaround where patching is not immediately possible, limiting or disabling SUNRPC-based services (e.g., NFS) over UDP or RDMA may reduce exposure.

A brief technical write-up on the vulnerability was published at infinitsec.net shortly after the CVE was disclosed in late December 2025. Detection coverage has been added by Nessus (plugin 281548) and Qualys (QID 761056), indicating scanner vendors have incorporated checks for this issue (Feedly, Tenable).