In the Linux kernel, the following vulnerability has been resolved:

NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Dan Aloni reports that he was able to hit a use-after-free bug if a
FREE_STATEID operation gets delayed for whatever reason. Fix this by
bumping the refcount of the 'struct nfs_server' object for the duration
of the FREE_STATEID so it doesn't get cleaned up from underneath us
while operations are still in flight.

https://git.kernel.org/stable/c/80ed3d762628b36c9e4b22fac7c65b72ef3b13dd

https://git.kernel.org/stable/c/af62f1af182d33a0de38308c012841885d8ab92e

https://git.kernel.org/stable/c/caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd

https://git.kernel.org/stable/c/cf616096a0f3a2b60f7d68b6b39674a6867ded9c

https://git.kernel.org/stable/c/d71dfffa512e71b166a889484e4c3b148a9a3af2

https://git.kernel.org/stable/c/d858ab09e787106432d4d9830bad9dfedf02f890

https://git.kernel.org/stable/c/ed1161ab6239761958b38d5667225634fc2be894

https://git.kernel.org/stable/c/ed2f92ce2fc48463c41e0e540b9a3454889e8af8

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfs/nfs4proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009","lessThan":"ed2f92ce2fc48463c41e0e540b9a3454889e8af8","versionType":"git","status":"affected"},{"version":"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009","lessThan":"d858ab09e787106432d4d9830bad9dfedf02f890","versionType":"git","status":"affected"},{"version":"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009","lessThan":"af62f1af182d33a0de38308c012841885d8ab92e","versionType":"git","status":"affected"},{"version":"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009","lessThan":"caee6a68ffaa5016dfc01cd0b3dc1896a32e3abd","versionType":"git","status":"affected"},{"version":"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009","lessThan":"ed1161ab6239761958b38d5667225634fc2be894","versionType":"git","status":"affected"},{"version":"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009","lessThan":"d71dfffa512e71b166a889484e4c3b148a9a3af2","versionType":"git","status":"affected"},{"version":"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009","lessThan":"80ed3d762628b36c9e4b22fac7c65b72ef3b13dd","versionType":"git","status":"affected"},{"version":"7c1d5fae4a87d3cf3e9ffd68bcdbaf6529013009","lessThan":"cf616096a0f3a2b60f7d68b6b39674a6867ded9c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfs/nfs4proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.10","status":"affected"},{"version":"0","lessThan":"3.10","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.152","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.104","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.45","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.9","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]