The vulnerability in the Linux kernel's nfsd component involved the nfsd4_copy_notify() function, where the copy-notify state ID was linked into internal data structures before full initialization and ownership recording. This timing allowed a race condition with an OFFLOAD_CANCEL request that could free the state entry while the caller still accessed it, resulting in a use-after-free condition. The fix involved recording ownership information and adding an extra reference before publishing the state entry to prevent premature freeing.

The vulnerability could lead to use-after-free memory access within the NFS server code, potentially causing kernel crashes or undefined behavior. No direct exploit in the wild is known, and no CVSS score is provided. The impact is primarily on system stability and security of the NFS server component.

A fix has been implemented in the Linux kernel to properly initialize and reference the copy-notify state ID before publishing it, preventing the race condition. Users should apply the relevant kernel updates containing this fix. No additional mitigation is indicated.