The vulnerability resides in the Linux kernel’s NFS server module, where multiple boolean fields in the nfsd_net structure are accessed concurrently without proper synchronization. The lack of atomicity allows two independent contexts to read and modify the same flag simultaneously, leading to double-free operations and corruption of linked list structures that track reclaimable client data. This race results in heap corruption and concurrent memory misuse, which can potentially be leveraged to gain arbitrary code execution at kernel privilege level.

All Linux kernel builds that compile the NFS server component and include the nfsd_net structure without the conversion to an atomic flag word are affected. The fix applies to the standard Linux kernel source and appears in commits referenced in the advisory, which are part of the official Linux distribution kernel releases beyond the original commit dates.

The CVSS score of 8.1 marks this flaw as high severity. The EPSS score is not available, so the likelihood of exploitation is unknown; however, the flaw introduces a classic race condition that is frequently abused by attackers for kernel escalation. It is not listed in the CISA KEV catalog. Attackers could trigger simultaneous NFS operations that cause concurrent walks of the reclaim hash table, leading to memory corruption and potential arbitrary code execution. The exploit path requires an attacker that can drive concurrent NFS client activity or manipulate server threads to induce the race.