The vulnerability in the Linux kernel's lockd subsystem was due to nlm_traverse_files() only pinning the current file with f_count++ across a mutex_unlock in nlm_inspect_file(), but failing to pin the saved 'next' pointer. This allowed a concurrent nlm_release_file() to free the 'next' file during the unlock window, causing the iterator to dereference freed memory in the next loop iteration. The fix pins both current and next files before dropping the lock and swaps pinned cursors to keep the 'next' file alive across the unlock. It also ensures nlm_file_release() is always called after dropping the iteration pin and uses nlm_file_inuse() for accurate evaluation of skipped files. This change results in deletion of stale files without locks or references during traversal, which was not handled by the old code.

The vulnerability could lead to use-after-free conditions in the Linux kernel lockd component, potentially causing kernel crashes or memory corruption. However, no known exploits in the wild have been reported. The fix prevents dereferencing freed memory by properly pinning files during iteration and improves cleanup of stale files.

A fix has been implemented in the Linux kernel to address this vulnerability by properly pinning files during iteration and improving cleanup of stale files. Users should update to the fixed kernel version once available. Patch status is not explicitly stated in the provided data; check the official Linux kernel advisories for the exact fixed versions and apply updates accordingly.