CVE-2023-54269
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the ...
Affects 1 product across 3 vendors.
A double free vulnerability exists in the Linux kernel's SUNRPC implementation, where the rq_xprt_ctxt pointer is not properly managed during deferred RPC request handling, potentially leading to memory corruption.
BSID: BS-2025-GLOBAL-177715-I • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2023-54269?
What is the CVSS score for CVE-2023-54269?
Is CVE-2023-54269 actively exploited?
How do I remediate CVE-2023-54269?
What systems are affected by CVE-2023-54269?
| CVE ID | CVE-2023-54269 |
|---|---|
| BSID | BS-2025-GLOBAL-177715-I BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2025-12-30 |
| Last Modified | 2026-10-15 |
| ICS Relevance | 0% |
| Source | NVD |
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - and also remains in the svc_deferred_req. In the (rare?) case that the request is deferred a second time, the old svc_deferred_req is reused - it still has all the correct content. However in that case the rq_xprt_ctxt pointer is NOT cleared so that when xpo_release_xprt is called, the ctxt is freed (UDP) or possible added to a free list (RDMA). When the deferred request is revisited for a second time, it will reference this ctxt which may be invalid, and the free the object a second time which is likely to oops. So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that the value is now stored in the svc_deferred_req.
Source: NIST NVD / MITRE CVE Database
An attacker could exploit this vulnerability by crafting a specific sequence of RPC requests that cause the double free condition, potentially leading to arbitrary code execution or system crash.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Clear | — | — |
| Kernel | — | — |
| Linux | Linux | 5.18 ≥ 5.15.35, < 5.15.113 ≥ 5.17.4, < 5.18 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 4291ce5af8ce2adbaf209bcdc7ae97e64df18d36e2f73bac09bf11eeab9a9d20a79c1b1ffb4b9b9c2882ee2dc720076eade9f3cd5ca5fd33e7e285e94e24d365 |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →