The Linux kernel’s NFS server opens the /proc/fs/nfs/exports entry and stores the current network namespace in a private field without taking a reference on the namespace itself. If the namespace is later destroyed—such as when a container exits after the opener has changed to another namespace—the NFS daemon frees the export cache. Read operations that continue on the still‑open file descriptor then dereference freed memory, causing a use‑after‑free condition that can corrupt kernel memory and produce a crash or, if an attacker can influence the freed region, arbitrary code execution. This flaw directly leads to memory corruption and a denial‑of‑service for the host.

All Linux kernel releases that include the NFS server module before the patch is applied are vulnerable. The fault originates in the mainline kernel source, so any distribution packaging a kernel that has not integrated the fix will be affected. No explicit version list was provided; thus any build of the kernel containing the unpatched NFS code is considered at risk.

Exploitation requires that an attacker can open /proc/fs/nfs/exports and subsequently cause the associated network namespace to be released while the file descriptor remains open. The attack vector is therefore limited to a local or compromised container or privileged user that can alter namespaces. EPSS and KEV data are not available, but the inherent use‑after‑free nature and the potential for kernel denial‑of‑service or privilege escalation make the risk moderate to high in environments running an unpatched NFS server exposed to untrusted processes or containers.