A flaw in the Linux kernel’s NFS daemon invalidates session slot management during V4 request argument decoding. When an ID mapping lookup upcall is timed out, the request is marked for deferral and dropped, preventing the normal response encoding from executing. Consequently the session slot flag never clears, causing subsequent client operations to fail with an NFSERR_JUKEBOX error, effectively denying service to legitimate clients and disrupting file system operations. This flaw is identified as a CWE-772 type vulnerability.

All Linux distributions running the Linux kernel exposed to the NFS daemon are potentially susceptible, as the vulnerability is located in the kernel’s NFS daemon. No vendor‑specific version list was provided, but any kernel configuration that enables NFSv4 without the patch is affected.

Based on the description, it is inferred that an attacker could exploit the flaw by sending crafted NFSv4 client requests that trigger ID mapping lookups. The EPSS score is < 1%, and the absence of a KEV listing indicates no known exploitation in the wild. The CVSS score of 5.5 denotes a moderate impact; an attacker with network access to the NFS server could induce a denial of service by sending repeated compound operations. The fix requires kernel changes that prevent any NFSv4 request from being deferred during idmap lookup.