A race condition within the Linux kernel’s NFS callback subsystem allows a backchannel receive to complete a request while the callback service is being torn down. This can cause a request to be enqueued onto a service that is about to be freed, resulting in a leaked reference to xprt_get and potential use‑of‑after‑free or other memory corruption in a CVSS score of 5.3, indicating it could lead to a moderate impact such as kernel instability or denial of service.

All Linux kernel releases are affected, regardless of vendor or distribution, because the flaw originates in the core kernel code. No specific version ranges are listed, so the patch must be applied at the earliest available kernel that incorporates the fix.

The CVSS score of 5.3 rates the vulnerability as moderate. The EPSS score is reported as < 1%, indicating a very limited likelihood of exploitation. The vulnerability relies on a race condition during the teardown of the NFS callback service. Based on the description, it is inferred that an attacker would need to trigger callback operations while the service is being shut down, a scenario that generally requires local or privileged access. The vulnerability is not listed in CISA KEV and no public exploit has been documented, so the threat remains moderate.