The nfsd4_drop_revoked_stid() routine in the Linux NFS server fails to handle the SC_TYPE_LAYOUT case. When an admin‑revoked layout state ID is freed by a client, the state ID remains registered in the kernel IDR and the per‑client list because it is never unhashed or released. The reference count therefore never reaches zero and the state ID is never freed, resulting in a memory leak that can grow without bound. This behavior is a classic example of uncontrolled resource consumption and a missing release of a resource after its effective lifetime (CWE‑772). In repeated or malicious use, the leak can exhaust available memory and degrade or crash the NFS server.

All Linux kernel installations that run the NFS server component and include the nfsd4_drop_revoked_stid() code path are potentially affected. No specific kernel version is listed in the advisory, so any kernel prior to the patch that implements this function may be vulnerable. The vulnerability applies regardless of distribution or custom kernel build as long as the affected code is present.

The CVSS score of 7.5 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests that current exploit activity is low to negligible. The vulnerability is not listed in the CISA KEV catalog. Attackers need only remote NFS client access; they can send a FREE_STATEID request referencing a revoked layout state ID to trigger the leak. Because the flaw is exercised over the network, it is remotely exploitable without local privileges, and repeated exploitation can lead to resource exhaustion, service degradation, or eventual denial of service.