Rob van der Putten wrote:
I think this may be a kernel bug.
A valid theory for now. I googled on:
https://askubuntu.com/questions/851986/rkhunter-reports-hidden-tcp-port-probably-nfs-server
brings me to
http://www.mail-archive.com/linux-kernel@vger.kernel.org/msg910866.html
Some suspicious kernel commit ids are mentioned in
http://www.mail-archive.com/linux-kernel@vger.kernel.org/msg911346.html
It looks like the original poster ended up speaking to himself. Insightful
but lonely.
One year late the problem appeared again
https://patchwork.kernel.org/patch/9207481/