The Linux kernel's nfsd async copy mechanism had a use-after-free vulnerability due to race conditions between teardown callers and the copy kernel thread. Specifically, find_async_copy() increased the copy's refcount but left it on a list, allowing concurrent cleanup to free resources prematurely. The NFSD4_COPY_F_STOPPED flag was set too early, causing teardown to free resources while the kthread still accessed them. The copy_task was not pinned, risking access to freed task_structs. The callback structure was referenced only by the client, allowing concurrent teardown to free the copy during callback execution. The fix unlinks the copy under a lock, manages references properly, pins the task_struct, and adjusts the order of operations to prevent races and premature frees.

This vulnerability could lead to use-after-free conditions in the kernel, potentially causing kernel crashes or memory corruption. While no active exploitation is known, such flaws can be leveraged for privilege escalation or denial of service in affected systems.

A fix has been implemented in the Linux kernel to address this vulnerability by correcting reference counting, locking, and task pinning in the async copy teardown process. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended mitigation.