Can you point to this please? From my reading, it appears that their earlier patches were merged, but there is no mention of them being actual vulnerabilities. The lkml thread does mention they want to revert these patches, just in case.
"A lot of these have already reached the stable trees. I can send you revert patches for stable by the end of today (if your scripts have not already done it)."
https://lore.kernel.org/linux-nfs/YH%2F8jcoC1ffuksrf@kroah.c...
It looks like actual security vulnerabilities were successfully added to the stable branch based on that comment.