The Linux kernel's nfsd_cross_mnt() function initializes a local struct path with mntget() and dget() before calling follow_down(). If follow_down() returns an error, the function previously failed to release these references, causing a reference leak. This leak inflates mount and dentry reference counts, preventing unmounting and causing dentries to be pinned against the shrinker. The vulnerability is exploitable by any authenticated NFS client through nfsd_lookup_dentry or the NFSv4 READDIR encode path. The patch fixes this by adding a call to path_put() before exiting on error, ensuring all references are properly released.

The vulnerability causes a resource leak in the kernel's mount and dentry reference counts, which can block unmount operations and pin dentries in memory. This may degrade system stability or resource availability. The issue requires an authenticated NFS client to trigger and does not directly allow code execution or privilege escalation. There are no known exploits in the wild.

A fix for this vulnerability has been implemented in the Linux kernel by adding a call to path_put() on all error returns from follow_down() in nfsd_cross_mnt(). Users should apply the official kernel update that includes this patch to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.