CVE-2025-39688: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
In the Linux kernel, the following vulnerability has been resolved:
nfsd: allow SCSTATUSFREEABLE when searching via nfs4lookupstateid()
The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERRDELEGREVOKED, but it gets bad NFS4ERRBADSTATEID instead.
When a delegation is revoked, it's initially marked with SCSTATUSREVOKED, or SCSTATUSADMINREVOKED and later, it's marked with the SCSTATUSFREEABLE flag, which denotes that it is waiting for s FREESTATEID call.
nfs4lookupstateid() accepts a statusmask that includes the status flags that a found stateid is allowed to have. Currently, that mask never includes SCSTATUSFREEABLE, which means that revoked delegations are (almost) never found.
Add SCSTATUSFREEABLE to the always-allowed status flags, and remove it from nfsd4delegreturn() since it's now always implied.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update nfsd to allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() so that revoked delegations are correctly handled (the DELEG8 test expects NFS4ERR_DELEG_REVOKED instead of NFS4ERR_BAD_STATEID).
nfsd (NFSv4) / nfs4_lookup_stateid() always-allowed status flags for statusmask = Add SC_STATUS_FREEABLE to the always-allowed status flags; previously SC_STATUS_FREEABLE was not included
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39688?
CVE-2025-39688 has been classified as a medium severity vulnerability due to its potential impact on NFS delegations in the Linux kernel.
How do I fix CVE-2025-39688?
To fix CVE-2025-39688, you should update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2025-39688?
CVE-2025-39688 affects systems running the Linux kernel with NFS server functionalities.
What does CVE-2025-39688 exploit?
CVE-2025-39688 exploits a flaw in the NFS server allowing SC_STATUS_FREEABLE during state ID lookup, which can impact delegation handling.
Is there a workaround for CVE-2025-39688?
The recommended workaround for CVE-2025-39688 is to disable NFS delegations until the kernel is updated.