The Linux kernel's NFS server (nfsd) had a vulnerability where nfsd4_sequence() could free session slots that were still in use. This occurred because the function free_session_slots() did not verify that the current request's slot ID was below the shrink boundary (se_target_maxslots) and did not check if slots were marked as in use (NFSD4_SLOT_INUSE) before freeing them. As a result, slots could be freed while still being processed, causing dangling pointers and memory corruption when the freed slot's memory was overwritten. The fix added checks to ensure the current slot ID is below the shrink boundary and scans for active slots before freeing, deferring shrink if any are active.

This vulnerability can cause use-after-free conditions and memory corruption within the NFS server kernel module, potentially leading to instability or denial of service. There is no indication of remote code execution or privilege escalation in the provided data. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by adding boundary checks and verifying slot usage before freeing session slots. Users should apply the official kernel updates that include this fix once available. Patch status is not explicitly stated in the input data; therefore, check the vendor advisory or Linux kernel mailing lists for the current remediation guidance.