CVE-2023-54269

A moderate severity flaw was found in the Linux kernel SUNRPC implementation used in Red Hat Enterprise Linux 8 and 9. When an RPC request is deferred, the rq_xprt_ctxt pointer is moved from the svc_rqst structure into a svc_deferred_req structure. If the same request is deferred a second time, the pointer is not cleared from the reused deferred-request structure, so the transport context can be released while still referenced and subsequently freed again. Successful exploitation requires an attacker with network access to a system running an affected NFSD service to trigger the rare condition of repeated deferrals of the same RPC request, resulting in memory corruption and a likely kernel oops, i.e. a denial of service. Red Hat rated this flaw CVSS 5.9 MODERATE (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) because triggering requires high attack complexity and the impact is limited to availability; this differs significantly from the upstream CRITICAL 9.8 score, which assumes low-complexity compromise of confidentiality, integrity, and availability that the technical evidence does not support. RHEL 7, RHEL 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present, and RHEL 6 is out of support scope. For the affected RHEL 8 and RHEL 9 kernel and kernel-rt z-branches the fix is deferred to a future update, leaving a residual risk of a low-probability kernel crash on systems running affected NFSD configurations.