The vulnerability occurs in the nfs4_preprocess_seqid_op() function where the stateid is referenced but the stateowner is not. When nfsd4_cstate_assign_replay() returns -EAGAIN due to the replay owner being torn down, the error handling incorrectly drops a stateowner reference that was never acquired, risking a use-after-free. Simultaneously, the stateid reference is leaked, which can stall concurrent nfsd4_close_open_stateid() calls waiting for the reference count to drop. The fix involves dropping the stateid reference (which is actually held) instead of the stateowner reference before retrying, ensuring proper reference management and preventing the use-after-free and resource leak.

This vulnerability can lead to use-after-free conditions on the stateowner object and resource leaks on the stateid reference count. Such conditions may cause kernel instability or denial of service by stalling concurrent NFS operations. There is no information about active exploitation in the wild.

A fix has been implemented in the Linux kernel to correct the reference counting behavior by dropping the stateid reference instead of the stateowner on seqid_op replay retries. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.