The vulnerability in Linux kernel NFSv4.1 relates to the decode_cb_sequence_args() function, which allocates csa_rclists using kmalloc_objs(), resulting in uninitialized referring_call_list pointers. When decode_rc_list() processes a valid list with zero referring calls, it does not initialize the rcl_refcalls pointer, leaving it with stale slab memory. Subsequently, nfs4_callback_sequence() passes this stale pointer to kfree(), causing potential memory corruption. The fix involves switching to kzalloc_objs() for allocation, ensuring all rcl_refcalls pointers start as NULL, including for empty referring call lists.

This vulnerability has a critical impact with a CVSS score of 9.8, allowing an attacker to cause memory corruption in the kernel, potentially leading to denial of service, privilege escalation, or arbitrary code execution. The flaw affects the kernel's NFSv4.1 callback sequence handling, which is a core component of network file system operations.

A fix is available that changes the allocation of csa_rclists to use zero-initialized memory (kzalloc_objs()). Users should apply the official Linux kernel patches that address this vulnerability. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation. No additional mitigation steps are indicated.