A hand‑rolled seqcount protocol in the NFS daemon was missing a read memory barrier before the second counter check. On architectures with weak memory ordering, such as ARM and POWER, the CPU may reorder reads past this check, allowing the retry loop to succeed while fields have been altered by a concurrent writer. This race can result in NFS clients receiving inconsistent or stale data, and in repeated retries may lead to a denial‑of‑service or data corruption scenario. The missing barrier directly enables improper synchronization between readers and writers.

All Linux kernel releases that have not incorporated the patch that adds the smp_rmb() before the second counter check. The vulnerability affects the generic nfsd implementation of the Linux kernel, so any distribution shipping those kernel versions is potentially impacted.

The CVSS score of 7.1 indicates a high level of risk, reflected by potential integrity and availability impact to NFS volumes. Although the EPSS score is not available, there is no indication that this flaw is part of CISA’s KEV list. Attackers could exploit the weakness remotely via the NFS service; the likely attack vector is an NFS client or a malicious user with access to the NFS export, who can trigger the race condition by repeatedly calling the status dump function.