The vulnerability in the Linux kernel's nfsd component occurs because nfsd4_alloc_layout_stateid reads the fp->fi_deleg_file pointer without holding the fi_lock when the parent stateid is a delegation. Concurrent delegation revokes can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering a BUG_ON. This race is client-reachable when one NFS client holds a delegation and another client opens the same file to force a recall. If the first client does not respond, the laundromat revokes the delegation concurrently with a LAYOUTGET operation from any client using the delegation stateid, hitting the race window. The fix adds fi_lock around the fi_deleg_file read and replaces the BUG_ON with a graceful error return that cleans up partially-initialized layout stateids.

The vulnerability can cause the NFS server to hit a BUG_ON condition, which typically results in a kernel panic or crash. This can lead to denial of service for clients relying on the NFS server. The race condition is reachable by clients interacting with file delegations, potentially causing service disruption.

No explicit vendor advisory or patch link is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves adding proper locking and replacing the BUG_ON with error handling in the Linux kernel source code. Users should monitor official Linux kernel releases and apply updates that include this fix once available.