The vulnerability in the Linux kernel's NFSD component involves a use-after-free condition during admin state revocation. Specifically, a stateid references an nfs4_client via a bare pointer without pinning, relying on __destroy_client() to drain stateids before freeing the client. However, nfsd4_revoke_states() drops the client lock while revoking stateids, allowing a race where the client can be freed before revoke_one_stid() dereferences it. The fix pins cl_rpc_users under client_lock to block teardown operations that would free the client prematurely, and skips clients already expired to avoid races.

This vulnerability could lead to use-after-free memory access in the Linux kernel's NFS server, potentially causing kernel crashes or undefined behavior. There is no information about active exploitation in the wild. The impact is limited to systems running the affected Linux kernel versions with NFSD enabled.

A fix has been implemented in the Linux kernel to properly pin client references during state revocation, preventing use-after-free conditions. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official fix and update guidance.