The Linux kernel's NFSD component had a flaw in the nfsd4_decode_secinfo_no_name() function where the sin_exp variable was initialized after decoding sin_style. If the XDR stream was truncated, the decoder returned an error before sin_exp was initialized. Due to a previous change that stopped clearing the inline iops array between RPC calls, a failed decode could leave sin_exp containing stale union data. The error handling path would then call exp_put() on this non-NULL, stale sin_exp, potentially causing improper resource handling. The fix involved initializing sin_exp before the first decode step, aligning with the behavior in nfsd4_decode_secinfo().

The vulnerability could cause improper cleanup of resources due to stale data usage in error handling within the NFS server code. While no direct exploit or impact such as privilege escalation or denial of service is documented, the flaw could lead to inconsistent state or resource management issues in the kernel's NFS server component.

A fix for this vulnerability has been implemented in the Linux kernel source code. Users should apply the official kernel updates that include this patch. Since this is not a cloud service, remediation requires updating affected Linux kernel versions once the patch is released. Patch status is not yet confirmed in this data; check the vendor advisory for current remediation guidance.