dbcve.org
VulnerabilityAwaiting classification

CVE-2023-54269

CRITICAL · 9.8 CVSS v3.1 Published 2025-12-30
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - and also remains in the svc_deferred_req. In the (rare?) case that the request is deferred a second time, the old svc_deferred_req is reused - it still has all the correct content. However in that case the rq_xprt_ctxt pointer is NOT cleared so that when xpo_release_xprt is called, the ctxt is freed (UDP) or possible added to a free list (RDMA). When the deferred request is revisited for a second time, it will reference this ctxt which may be invalid, and the free the object a second time which is likely to oops. So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that the value is now stored in the svc_deferred_req.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A double-free vulnerability exists in the Linux kernel's SUNRPC subsystem where the rq_xprt_ctxt pointer is not cleared when a deferred request is deferred a second time. This causes the transport context to be freed (UDP) or added to a free list (RDMA) while still referenced, leading to a use-after-free and second free when the deferred request is revisited, resulting in an Oops/crash.

MitigationApply the kernel patch that modifies svc_defer() to always clear rq_xprt_ctxt after storing it in svc_deferred_req, preventing the double-free condition.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check kernel version
    Run 'uname -r' or 'cat /proc/version' to get the running kernel version. Compare against known vulnerable and fixed versions for your distribution.
    Affected if The kernel version is older than the version that includes the fix for this CVE (the fix clears rq_xprt_ctxt in svc_defer()).
  2. Verify SUNRPC server is in use
    Check if the kernel has SUNRPC/nfsd loaded or running: 'lsmod | grep sunrpc' or 'systemctl status nfs-server' (for NFS servers) or check for any RPC services using 'rpcinfo -p'.
    Affected if The system runs as an NFS server, RPC service, or other SUNRPC server application that can receive and defer RPC requests.
  3. Confirm RPC request deferral capability is enabled
    Inspect kernel config for CONFIG_SUNRPC and related options: 'grep -i sunrpc /boot/config-$(uname -r)' or check if /proc/sys/sunrpc is accessible and configured.
    Affected if SUNRPC is compiled into or loaded by the kernel, and the server handles RPC requests that can be deferred (common in NFS operations).
  4. Check for the specific code fix if kernel source is available
    If kernel source is available, examine net/sunrpc/svcsock.c for the svc_defer() function. Look for a line that clears rq_xprt_ctxt after storing the context, e.g., 'rq_xprt_ctxt = NULL' after the svc_deferred_req assignment.
    Affected if The svc_defer() function lacks code to clear rq_xprt_ctxt after deferring a request, allowing the double-free condition.
  5. Monitor for kernel oops/crash indicators in logs
    Review /var/log/messages, dmesg output, or journalctl for kernel panics, oops messages, or double-free errors related to sunrpc, xprt, or nfsd.
    Affected if Kernel crashes with oops messages referencing 'xprt_ctxt' or 'svc_defer' appear in system logs, indicating active exploitation or triggering of the bug.

A system is affected if it runs an unpatched kernel version with SUNRPC server functionality enabled, where RPC requests can be deferred and the svc_defer() function does not clear rq_xprt_ctxt after the first deferral.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply the kernel patch that modifies svc_defer() to always clear rq_xprt_ctxt after storing it in svc_deferred_req, preventing the double-free condition.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation1.0 h
  • Testing4.0 h
  • Review / QA2.0 h
9.0 hours of engineering $1,540
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,464.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-54269 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-54269 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data