A critical use-after-free vulnerability in the Linux kernel NFS subsystem allows unauthenticated remote attackers to achieve full system compromise.

This is a use-after-free flaw occurring in the nfsd4_copy_notify function. An unauthenticated attacker can trigger a race condition by sending a crafted OFFLOAD_CANCEL request, causing the kernel to free memory that is still in use, which results in memory corruption and potential code execution.

The CVSS score of 9.8 reflects the high severity of this vulnerability, as it allows for unauthenticated remote code execution. A successful exploit could lead to complete system takeover, unauthorized access to sensitive data stored on NFS shares, and severe service disruption, posing a significant risk to organizational data integrity and availability.

Immediate Action: Update your Linux kernel to the versions specified in the OSV fixed packages (5.10.270, 5.15.221, 6.1.188, 6.6.157 or later) as soon as possible.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected system crashes that may indicate exploitation attempts, particularly those involving NFS-related processes.

Compensating Controls: If patching is not immediately feasible, restrict network access to the NFS service to trusted IP addresses only, and consider disabling the NFS copy-notify feature if it is not required for production operations.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level vulnerability and the lack of authentication required for exploitation, immediate patching is imperative. System administrators should prioritize the deployment of kernel updates to all affected environments to eliminate the risk of remote code execution and system compromise.