---
id: CVE-2023-54269
title: 'SUNRPC: double free xprt_ctxt while still in use'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  SUNRPC: double free xprt_ctxt while still in use

  When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out
  of the svc_rqst into the svc_deferred_req.
  When…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f5e13d700a4d40ccde3d36e383f9247dcb3c1d2d <
    7851771789e87108a92697194105ef0c9307dc5e
  - >-
    Linux >= 773f91b2cf3f52df0d7508fdbf60f37567cdaee4 <
    fd86534872f445f54dc01e7db001e25eadf063a8
  - >-
    Linux >= 773f91b2cf3f52df0d7508fdbf60f37567cdaee4 <
    e0c648627322a4c7e018e5c7f837c3c03e297dbb
  - >-
    Linux >= 773f91b2cf3f52df0d7508fdbf60f37567cdaee4 <
    eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1
  - Linux 11fab500f86403b2ebf6795feeade6e10302e448
  - Linux >= 5.15.35 < 5.15.113
  - Linux >= 5.17.4 < 5.18
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-15T21:39:56.402453Z'
published: '2025-12-30'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:43.730Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54269'
references:
  - url: 'https://git.kernel.org/stable/c/7851771789e87108a92697194105ef0c9307dc5e'
  - url: 'https://git.kernel.org/stable/c/fd86534872f445f54dc01e7db001e25eadf063a8'
  - url: 'https://git.kernel.org/stable/c/e0c648627322a4c7e018e5c7f837c3c03e297dbb'
  - url: 'https://git.kernel.org/stable/c/eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1'
tags:
  - cve.org
epss: 0.00548
epssPercentile: 0.44538
ingestedAt: '2026-10-15T22:48:25.437Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: double free xprt_ctxt while still in use

When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out
of the svc_rqst into the svc_deferred_req.
When the deferred request is revisited, the pointer is copied into
the new svc_rqst - and also remains in the svc_deferred_req.

In the (rare?) case that the request is deferred a second time, the old
svc_deferred_req is reused - it still has all the correct content.
However in that case the rq_xprt_ctxt pointer is NOT cleared so that
when xpo_release_xprt is called, the ctxt is freed (UDP) or possible
added to a free list (RDMA).
When the deferred request is revisited for a second time, it will
reference this ctxt which may be invalid, and the free the object a
second time which is likely to oops.

So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that
the value is now stored in the svc_deferred_req.

## Affected

- `Linux >= f5e13d700a4d40ccde3d36e383f9247dcb3c1d2d < 7851771789e87108a92697194105ef0c9307dc5e`
- `Linux >= 773f91b2cf3f52df0d7508fdbf60f37567cdaee4 < fd86534872f445f54dc01e7db001e25eadf063a8`
- `Linux >= 773f91b2cf3f52df0d7508fdbf60f37567cdaee4 < e0c648627322a4c7e018e5c7f837c3c03e297dbb`
- `Linux >= 773f91b2cf3f52df0d7508fdbf60f37567cdaee4 < eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1`
- `Linux 11fab500f86403b2ebf6795feeade6e10302e448`
- `Linux >= 5.15.35 < 5.15.113`
- `Linux >= 5.17.4 < 5.18`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.