A critical race condition vulnerability in the Linux kernel sunrpc subsystem could allow an unauthenticated remote attacker to achieve arbitrary code execution or cause system instability.

This vulnerability involves a race condition in the sunrpc xprtsock component where socket callback pointers are accessed without proper concurrency protection. An unauthenticated attacker can trigger this state by exploiting the lack of READ_ONCE and WRITE_ONCE annotations during socket teardown, leading to the execution of stale callback functions.

The potential for unauthorized system access, data corruption, or service interruption is severe. Given the CVSS score of 9.8, this flaw represents a critical risk to infrastructure integrity, as it allows remote attackers to potentially gain full control over affected systems without requiring user interaction or authentication.

Immediate Action: Apply the latest security patches provided by your Linux distribution maintainer to update the kernel to version 6.6.157, 6.12.110, 6.18.52, 7.2.6, or later.

Proactive Monitoring: Monitor system logs for unusual kernel panics or repeated service crashes within the sunrpc or network stack components that may indicate exploitation attempts.

Compensating Controls: Ensure that network traffic is restricted to known, trusted sources using host-based firewalls or network access control lists to limit the exposure of RPC-related services.

Public Exploit Available: Unknown

Due to the critical severity and the potential for full system compromise, organizations should prioritize patching their Linux kernel environments immediately. System administrators should verify the patched kernel version post-update and ensure that automated update mechanisms are functioning correctly to prevent exposure to this and similar kernel-level threats.