CVE-2023-54269
A critical bug in the Linux kernel’s RPC subsystem can cause a double free, potentially crashing the system. The flaw occurs when an RPC request is deferred twice, leading to an invalid memory reference. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, especially those running older kernel versions that have not applied the latest security updates. Typical users include system administrators and anyone maintaining Linux servers or devices.
Real-world impact
An attacker could trigger the double free by sending specially crafted RPC requests, causing the kernel to crash or potentially execute arbitrary code if the crash is exploitable. This could lead to denial of service or privilege escalation on the affected system.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, and the fact that it can be exploited remotely without authentication or user interaction.
What to do about it
- 01Verify the current kernel version on your system.
- 02Install the latest kernel update from your distribution’s official repositories, which includes the fix for the double‑free bug.
NVD description indicates the issue has been resolved in kernel updates.
Timeline
- Dec 30, 2025 · Dec 30, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.