The flaw in nfsd4_add_rdaccess_to_wrdeleg allows an NFS client thread to over‑increment the reference counter of an nfs4_file object. When the NFS server stops, the inflated counter prevents the corresponding nfsd_file from being freed. The unfinished kernel object triggers a BUG in kmem_cache_destroy() as the cache is torn down, potentially corrupting memory or causing a crash. This affects the integrity and availability of the NFS service during termination.

The vulnerability exists in all Linux kernel versions that contain the buggy nfsd4 implementation, regardless of distribution. Any system running nfs-server and handling concurrent NFSv4 access can be exposed until the patch is applied. The issue is not limited to a particular vendor; it applies to the upstream Linux kernel shared by all distributions.

No public exploitation reports exist, and the EPSS score is unavailable, but the lack of a KEV listing does not diminish the potential impact. The flaw requires an operational NFS server; a remote attacker could trigger the condition by generating high volumes of concurrent read and write delegations. The risk is significant if the NFS service is part of a critical infrastructure, as it can lead to kernel instability or denial of service. The CVSS score is not provided, but the severity can be inferred from the kernel BUG and memory leak.