{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-11T07:53:21.320","vulnerabilities":[{"cve":{"id":"CVE-2023-54269","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2025-12-30T13:16:15.737","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: double free xprt_ctxt while still in use\n\nWhen an RPC request is deferred, the rq_xprt_ctxt pointer is moved out\nof the svc_rqst into the svc_deferred_req.\nWhen the deferred request is revisited, the pointer is copied into\nthe new svc_rqst - and also remains in the svc_deferred_req.\n\nIn the (rare?) case that the request is deferred a second time, the old\nsvc_deferred_req is reused - it still has all the correct content.\nHowever in that case the rq_xprt_ctxt pointer is NOT cleared so that\nwhen xpo_release_xprt is called, the ctxt is freed (UDP) or possible\nadded to a free list (RDMA).\nWhen the deferred request is revisited for a second time, it will\nreference this ctxt which may be invalid, and the free the object a\nsecond time which is likely to oops.\n\nSo change svc_defer() to *always* clear rq_xprt_ctxt, and assert that\nthe value is now stored in the svc_deferred_req."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nSUNRPC: doble liberación de xprt_ctxt mientras aún está en uso\n\nCuando una solicitud RPC es diferida, el puntero rq_xprt_ctxt es movido fuera del svc_rqst hacia el svc_deferred_req.\nCuando la solicitud diferida es revisitada, el puntero es copiado en el nuevo svc_rqst - y también permanece en el svc_deferred_req.\n\nEn el caso (¿raro?) de que la solicitud sea diferida por segunda vez, el antiguo svc_deferred_req es reutilizado - aún tiene todo el contenido correcto.\nSin embargo, en ese caso el puntero rq_xprt_ctxt NO es limpiado de modo que cuando se llama a xpo_release_xprt, el ctxt es liberado (UDP) o posiblemente añadido a una lista de libres (RDMA).\nCuando la solicitud diferida es revisitada por segunda vez, hará referencia a este ctxt el cual puede ser inválido, y liberará el objeto por segunda vez lo que probablemente causará un 'oops'.\n\nAsí que cambie svc_defer() para *siempre* limpiar rq_xprt_ctxt, y afirme que el valor ahora está almacenado en el svc_deferred_req."}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7851771789e87108a92697194105ef0c9307dc5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0c648627322a4c7e018e5c7f837c3c03e297dbb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb8d3a2c809abd73ab0a060fe971d6b9019aa3c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd86534872f445f54dc01e7db001e25eadf063a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}]}