The vulnerability in the Linux kernel's nfsd subsystem was caused by the fcache disposal queue living in a separately allocated struct nfsd_fcache_disposal, which could be freed during per-net teardown while callbacks or the shrinker were still accessing it. This use-after-free condition was addressed by inlining the spinlock and freeme list directly into struct nfsd_net, ensuring these fields share the same lifetime as the network namespace. This change removes the separately allocated struct and associated allocation/free helpers, preventing dangling pointer dereferences in nfsd_file_dispose_list_delayed().

The use-after-free vulnerability could lead to memory corruption within the kernel's NFS daemon, potentially causing system instability or crashes. No specific exploitation details or active exploits are reported. The impact is limited to the affected kernel subsystem and could affect systems running vulnerable kernel versions.

A fix has been implemented that eliminates the use-after-free by inlining the disposal state into the network namespace structure. Users should apply the official Linux kernel updates that include this fix. Since the vulnerability is resolved in the kernel source, upgrading to a patched kernel version is the recommended remediation. No additional mitigations are indicated.