The vulnerability in the Linux kernel's nfsd component arises because the rpc_status netlink dumpit function reads operation numbers from a vmalloc buffer (args->ops) that is freed synchronously by vfree() at the end of each compound operation. Although the svc_rqst struct is protected by an RCU read lock, the vmalloc buffer is not deferred for freeing, allowing a concurrent compound completion to free the buffer while it is still being read, causing a use-after-free on vmalloc memory. The fix replaces vfree(args->ops) with kvfree_rcu_mightsleep(), which defers the free until after an RCU grace period, ensuring safe access during the dumpit's RCU read lock.

This use-after-free vulnerability could lead to memory corruption or kernel instability if the freed buffer is accessed concurrently. However, no known exploits in the wild have been reported. The impact is limited to the Linux kernel's NFS server handling of compound operations.

A fix is available that defers freeing the vmalloc buffer until after an RCU grace period by using kvfree_rcu_mightsleep() instead of vfree(). Users should apply the official Linux kernel update that includes this fix to prevent the use-after-free condition.