The vulnerability in the Linux kernel's nfsd component was due to a race condition in nfs4_alloc_init_cpntf_state(), where the cpntf entry was published into the s2s_cp_stateids IDR with cs_type set in one critical section, but the subsequent list_add() operation on p_stid->sc_cp_list occurred after releasing the lock. This gap allowed a racing OFFLOAD_CANCEL operation from any NFSv4.2 client to invoke manage_cpntf_state() and _free_cpntf_state_locked(), which performed list_del() on an uninitialized list_head, causing a kernel oops (crash). The patch folds cs_type assignment and list_add() into the same critical section as idr_alloc_cyclic(), initializes the list head immediately after allocation, and modifies _free_cpntf_state_locked() to use list_del_init() to make stale unlink attempts safe. The fix preserves NFS4_COPY_STID semantics by skipping list_add when p_stid is NULL.

Exploitation of this race condition can cause the Linux kernel NFS server to crash (kernel oops), leading to denial of service for clients relying on NFSv4.2. The vulnerability can be triggered by any NFSv4.2 client sending an OFFLOAD_CANCEL operation, potentially disrupting server availability.

A fix has been implemented in the Linux kernel to address this race condition by ensuring atomic updates and safe list operations in the cpntf state management code. Users should apply the official kernel update containing this patch to remediate the issue. No additional mitigation steps are indicated beyond applying the fix.