The Linux kernel's nfsd_dispatch() function uses rq_status_counter as a seq-lock-like mechanism with a lockless reader in nfsd_nl_rpc_status_get_dumpit(). The counter is set to an odd value when a request is decoded and should be restored to even once fully processed. However, only the fully successful path restored it to even; other paths such as cache-hit, drop, and encode-error returned early, leaving the counter odd. This caused the lockless reader to treat fields as stable when they were actively mutating, allowing it to read past the end of an 8-element inline ops array. The fix adds a helper to advance the counter to the next even value on all exit paths following the odd-valued store, except the decode-error path which is reached before the counter is set odd.

The vulnerability could allow a lockless reader to access unstable and actively mutating kernel data structures, potentially leading to out-of-bounds reads. This may cause kernel memory corruption or information disclosure. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to ensure rq_status_counter is restored to an even value on all nfsd_dispatch() exit paths after being set odd. Users should apply the official kernel update that includes this patch. No additional mitigation is required beyond applying the fix.