In the Linux kernel, the following vulnerability has been resolved:

sunrpc: defer rq argp and rq resp free until after RCU grace period

svc rqst free() frees rqstp->rq argp and rqstp->rq resp synchronously via kfree(), but defers the rqstp struct free via kfree rcu(). After svc exit thread() calls list del rcu() and svc rqst free(), there is a window where RCU readers that started before list del rcu() can still traverse the thread list and find the rqstp. These readers (e.g. nfsd nl rpc status get dumpit()) dereference rqstp->rq argp, which has already been freed — a use-after-free.

Fix this by moving the kfree of rq argp and rq resp into an explicit call rcu() callback alongside the struct free. Resources not accessed by RCU readers (bvec, buffer pages, scratch folio, auth data) remain synchronously freed.