The Linux kernel's NFS server (nfsd) had a vulnerability in the OFFLOAD_CANCEL path where the function manage_cpntf_state() freed a target copy-notify state without checking if the requesting client owned it. The lookup key used is cyclically allocated and guessable, and the embedded clientid is fixed per network namespace, allowing any authenticated NFSv4.2 client to cancel and free another client's copy-notify stateid. The patch compares the creating clientid recorded in the state against the requesting client's clientid and returns an error (nfserr_bad_stateid) if they do not match, preventing unauthorized cancellation.

Any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid, potentially disrupting legitimate client operations or causing denial of service related to NFS state management. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been applied in the Linux kernel to verify client ownership before cancelling a copy-notify stateid. Users should update to the fixed kernel version containing this patch. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation.