A critical use-after-free vulnerability in the Linux kernel NFS implementation could allow an attacker to trigger memory corruption and potentially achieve arbitrary code execution.

The vulnerability exists in the nfsd4_drop_revoked_stid function, which fails to set the SC_STATUS_FREED flag when handling admin-revoked delegations. This omission allows the kernel to incorrectly process freed delegations, leading to a use-after-free condition when the client state is destroyed.

Successful exploitation of this vulnerability can lead to a system crash, denial of service, or potentially arbitrary code execution at the kernel level. Given the high CVSS score of 9.8, this flaw poses a severe risk to the confidentiality, integrity, and availability of any server hosting NFS services, potentially exposing sensitive data or providing a foothold for further network compromise.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or unusual NFS server restarts that may indicate triggered memory corruption.

Compensating Controls: Restrict access to the NFS server to trusted network segments and minimize exposure of the NFS service to untrusted environments until patching is complete.

Public Exploit Available: Unknown

This vulnerability represents a critical security risk due to its potential for kernel-level impact. System administrators must prioritize patching the Linux kernel across all affected NFS-enabled environments. Given the severity of potential exploitation, verification of kernel updates should be performed immediately to ensure the fix is applied.