A critical use-after-free vulnerability in the Linux kernel NFS daemon (nfsd) exposes systems to potential remote code execution and system instability.

The vulnerability exists within the nfsd async copy mechanism, where race conditions during teardown processes (such as OFFLOAD_CANCEL) lead to a use-after-free condition. An unauthenticated remote attacker can trigger this flaw by manipulating NFS copy requests, leading to memory corruption, service disruption, or arbitrary code execution.

The CVSS score of 9.8 reflects the severity of this vulnerability, as it allows for unauthenticated remote exploitation with full impact on confidentiality, integrity, and availability. Successful exploitation could result in a complete system compromise, unauthorized access to sensitive file system data, or denial of service, posing a significant risk to organizational infrastructure that relies on NFS for data storage.

Immediate Action: Apply the vendor-provided kernel patches immediately by updating the Linux kernel to version 6.18.51, 7.2.4, or later.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual NFS-related service activity that may indicate exploitation attempts.

Compensating Controls: Restrict access to the NFS service to authorized networks only and implement firewall rules to limit exposure of the nfsd port to untrusted traffic.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level vulnerability and the potential for unauthenticated remote code execution, patching should be prioritized as part of the next maintenance cycle. Organizations using NFS services should verify their kernel versions and apply the specified updates to mitigate the risk of system compromise.