In the Linux kernel, the following vulnerability has been resolved:

NFSD: Prevent lock owner use-after-free during client teardown

destroy client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl ownerstr hashtbl. client has state() does not count a bare owner, so DESTROY CLIENTID can reach destroy client() with such owners present.

destroy client() then walks the table, calling remove blocked locks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flc owner. The per-net laundromat reaps blocked locks from nn->blocked locks lru independently of client state. The two paths share blocked locks lock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as destroy client() dereferences it, a NULL dereference in remove blocked locks().

nfsd4 release lockowner() holds a reference across the same call; destroy client() does not. Hold cl lock across the walk, taking a reference and unhashing each owner, then drop it before remove blocked locks() and nfs4 put stateowner(), which take blocked locks lock and cl lock.