The flaw in nfsd4_add_rdaccess_to_wrdeleg is a reference‑counting error delineated as CWE‑911, allowing an NFS client thread to over‑increment the reference counter of an nfs4_file object. When the NFS server stops, the inflated counter prevents the corresponding nfsd_file from being freed. The unfinished kernel object triggers a BUG in kmem_cache_destroy() as the cache is torn down, potentially corrupting memory or causing a crash. This affects the integrity and availability of the NFS service during termination.

The vulnerability exists in all Linux kernel versions that contain the buggy nfsd4 implementation, regardless of distribution. Any system running nfs-server and handling concurrent NFSv4 access can be exposed until the patch is applied. The issue is not limited to a particular vendor; it applies to the upstream Linux kernel shared by all distributions.

No public exploitation reports exist, and the EPSS score is < 1%, but the lack of a KEV listing does not diminish the potential impact. Based on the description, it is inferred that an attacker with network access to the NFS server could trigger the condition by generating high volumes of concurrent read and write delegations. The risk is significant if the NFS service is part of a critical infrastructure, as it can lead to kernel instability or denial of service. The CVSS score of 7.5 indicates a high severity, but the kernel BUG and memory leak also indicate a significant risk.