A critical use-after-free vulnerability exists in the Linux kernel NFS implementation, which could allow an unauthenticated attacker to cause memory corruption or system crashes.

The vulnerability stems from an incorrect order of operations during asynchronous NFS COPY requests, where a state identifier is registered in the IDR before the necessary data structures are duplicated. This results in the IDR referencing transient, per-request memory that is subsequently reused, allowing an attacker to trigger use-after-free conditions via IDR walkers that dereference invalid pointers.

The CVSS score of 9.8 reflects the high potential for impact, as this flaw permits unauthenticated remote attackers to trigger memory corruption. Successful exploitation can lead to a complete denial of service through kernel panic or potentially facilitate arbitrary code execution, resulting in significant operational disruption and loss of data integrity for critical file server infrastructure.

Immediate Action: Update your Linux kernel to version 6.18.50, 7.2.4, or later to incorporate the official upstream patches.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or frequent NFS service restarts that may indicate exploitation attempts or instability related to memory corruption.

Compensating Controls: Restrict access to the NFS service to trusted network segments using firewalls, as this significantly reduces the attack surface for remote, unauthenticated exploit attempts.

Public Exploit Available: No

Given the critical nature of this kernel vulnerability and the ease of network access required to trigger the flaw, organizations should prioritize patching their NFS server implementations. Apply the recommended kernel updates as part of the next maintenance cycle to eliminate the risk of memory-based attacks and system instability.