Riskcovery

CVE-2025-39688

nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()

State
Published
Severity
7.5 High
Published
Apr 18, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()

The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERR_DELEG_REVOKED, but it gets bad NFS4ERR_BAD_STATEID instead.

When a delegation is revoked, it's initially marked with SC_STATUS_REVOKED, or SC_STATUS_ADMIN_REVOKED and later, it's marked with the SC_STATUS_FREEABLE flag, which denotes that it is waiting for s FREE_STATEID call.

nfs4_lookup_stateid() accepts a statusmask that includes the status flags that a found stateid is allowed to have. Currently, that mask never includes SC_STATUS_FREEABLE, which means that revoked delegations are (almost) never found.

Add SC_STATUS_FREEABLE to the always-allowed status flags, and remove it from nfsd4_delegreturn() since it's now always implied.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a to before 52e209203c35a4fbff8af23cd3613efe5df40102Affected
  • 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a to before dc6f3295905d7185e71091870119a8c11c3808ccAffected
  • 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a to before 5bcb44e650bc4ec7eac23df90c5e011a77fa2bebAffected
  • 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a to before d1bc15b147d35b4cb7ca99a9a7d79d41ca342c13Affected
  • 967faa26f313a62e7bebc55d5b8122eaee43b929Affected
  • 6.11.6 to before 6.12Affected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.23 through 6.12.*Not affected
  • 6.13.11 through 6.13.*Not affected
  • 6.14.2 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.