The vulnerability in the Linux kernel's nfsd subsystem involved the mishandling of copy-notify stateids (cs_count references) during revocation. Specifically, the function _free_cpntf_state_locked() only unlinked entries when their reference count reached zero. However, concurrent holders elevating cs_count could cause the reference to be dropped without unlinking, leaving entries discoverable but with consumed membership references. Subsequent revokes or cleanup could free these entries while still referenced, causing a use-after-free detected by KASAN. The fix introduced revoke_cpntf_state_locked(), which unhashes and unlinks entries before freeing, ensuring safe revocation across all affected paths.

This vulnerability could lead to a kernel use-after-free condition in the NFS server component, potentially causing system instability or crashes. No information about exploitation in the wild or privilege escalation is provided. The impact is limited to kernel memory safety and stability.

A fix has been implemented in the Linux kernel to properly revoke copy-notify stateids before dropping their references, preventing use-after-free conditions. Users should apply the official kernel updates that include this patch. No additional mitigation steps are indicated.