The vulnerability in the Linux kernel NFSD subsystem involves a use-after-free condition triggered by writing a filesystem path to /proc/fs/nfsd/unlock_filesystem after the NFS server has shut down. Specifically, the function nfsd4_cancel_copy_by_sb() runs before acquiring the nfsd_mutex and before confirming that nn->nfsd_serv is set. After shutdown, nn->conf_id_hashtbl is freed but the pointer remains, causing iteration over freed memory and dereferencing invalid client pointers. The fix moves the asynchronous copy cancel operation under the protection of nfsd_mutex and confirms the server is running, ensuring no access to freed memory.

A local administrator with CAP_SYS_ADMIN privileges can trigger a use-after-free condition, potentially leading to kernel memory corruption or system instability. There is no indication of remote exploitation or active exploitation in the wild.

A fix has been applied in the Linux kernel to move the asynchronous copy cancel operation under the nfsd_mutex lock and confirm the server is running before accessing state tables. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.