A critical use-after-free vulnerability in the Linux kernel NFS daemon could allow a remote attacker to trigger memory corruption or system compromise.

This is a use-after-free vulnerability located within the nfs40_clean_admin_revoked function of the NFSD component. It occurs because the stateid reference does not correctly pin the client during a race condition with client teardown, allowing an unauthenticated attacker to trigger a dereference of freed memory.

The CVSS score of 9.8 reflects the high severity of this flaw, as it allows for unauthenticated remote exploitation. Successful exploitation can lead to arbitrary code execution, unauthorized data access, or denial of service, potentially resulting in full system compromise and significant operational downtime for enterprise environments relying on NFS services.

Immediate Action: Update your Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unexpected NFSD process crashes that may indicate exploitation attempts.

Compensating Controls: Restrict access to NFS ports (typically TCP/UDP 2049) to trusted networks only using host-based firewalls or network access control lists to reduce the attack surface.

Public Exploit Available: Unknown.

Given the critical nature of this kernel-level flaw and the potential for remote code execution, administrators should prioritize patching their Linux environments immediately. Apply the relevant kernel updates as soon as they are made available by your operating system vendor to mitigate the risk of memory corruption and potential system takeover.