The vulnerability involves a use-after-free condition in the Linux kernel's NFSD component during NFSv4.0 revoked-state cleanup. Specifically, the function nfs40_clean_admin_revoked() takes a stateid reference under a client lock, drops another lock, and calls nfsd4_drop_revoked_stid(), which dereferences the client without properly pinning it. This can lead to the client being freed concurrently while still being accessed, due to a race between periodic cleanup (laundromat) and client expiration triggered by control file writes. The fix involves skipping clients already expiring and properly pinning the client reference with cl_rpc_users under client_lock before releasing the lock, aligning with existing state revocation logic.

The vulnerability could lead to use-after-free conditions in the kernel, which may cause system instability or crashes. The description does not specify exploitation or privilege escalation impacts. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to properly pin client references during NFSv4.0 revoked-state cleanup, preventing use-after-free conditions. Users should apply the official kernel updates that include this fix. No additional mitigation steps are indicated.