In the Linux kernel, the following vulnerability has been resolved:
nfsd: allow SCSTATUSFREEABLE when searching via nfs4lookupstateid()
The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERRDELEGREVOKED, but it gets bad NFS4ERRBADSTATEID instead.
When a delegation is revoked, it's initially marked with SCSTATUSREVOKED, or SCSTATUSADMINREVOKED and later, it's marked with the SCSTATUSFREEABLE flag, which denotes that it is waiting for s FREESTATEID call.
nfs4lookupstateid() accepts a statusmask that includes the status flags that a found stateid is allowed to have. Currently, that mask never includes SCSTATUSFREEABLE, which means that revoked delegations are (almost) never found.
Add SCSTATUSFREEABLE to the always-allowed status flags, and remove it from nfsd4_delegreturn() since it's now always implied.
[
{
"target": {
"function": "nfsd4_delegreturn",
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"length": 756.0,
"function_hash": "241582200125392572860052112390930492590"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc6f3295905d7185e71091870119a8c11c3808cc",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-39688-0e44111b"
},
{
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"line_hashes": [
"265262745975627726795618947370318873844",
"105393387507778711775881332672245637481",
"53280745116243887249013163989886476026",
"27344580358738151070768424627348653694",
"91287606238236691560348299204863275995",
"272215595042594414469865431467991252912",
"230311470710672782337807019294106840256",
"30809748549444197267972819724925409550",
"130315548196951428087774290074848504562",
"75102091838419912731639683817463759794"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52e209203c35a4fbff8af23cd3613efe5df40102",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-39688-49d60222"
},
{
"target": {
"function": "nfsd4_lookup_stateid",
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"length": 1009.0,
"function_hash": "81527707910787231827616069313251165304"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc6f3295905d7185e71091870119a8c11c3808cc",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-39688-6a149bfb"
},
{
"target": {
"function": "nfsd4_delegreturn",
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"length": 756.0,
"function_hash": "241582200125392572860052112390930492590"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52e209203c35a4fbff8af23cd3613efe5df40102",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-39688-6c7d0ba9"
},
{
"target": {
"function": "nfsd4_lookup_stateid",
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"length": 1009.0,
"function_hash": "81527707910787231827616069313251165304"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52e209203c35a4fbff8af23cd3613efe5df40102",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-39688-82e68a6a"
},
{
"target": {
"function": "nfsd4_lookup_stateid",
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"length": 1009.0,
"function_hash": "81527707910787231827616069313251165304"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bcb44e650bc4ec7eac23df90c5e011a77fa2beb",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-39688-c4009cab"
},
{
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"line_hashes": [
"265262745975627726795618947370318873844",
"105393387507778711775881332672245637481",
"53280745116243887249013163989886476026",
"27344580358738151070768424627348653694",
"91287606238236691560348299204863275995",
"272215595042594414469865431467991252912",
"230311470710672782337807019294106840256",
"30809748549444197267972819724925409550",
"130315548196951428087774290074848504562",
"75102091838419912731639683817463759794"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc6f3295905d7185e71091870119a8c11c3808cc",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-39688-c9e32e61"
},
{
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"line_hashes": [
"265262745975627726795618947370318873844",
"105393387507778711775881332672245637481",
"53280745116243887249013163989886476026",
"27344580358738151070768424627348653694",
"91287606238236691560348299204863275995",
"272215595042594414469865431467991252912",
"230311470710672782337807019294106840256",
"30809748549444197267972819724925409550",
"130315548196951428087774290074848504562",
"75102091838419912731639683817463759794"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bcb44e650bc4ec7eac23df90c5e011a77fa2beb",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-39688-d48fe6a7"
},
{
"target": {
"function": "nfsd4_delegreturn",
"file": "fs/nfsd/nfs4state.c"
},
"digest": {
"length": 756.0,
"function_hash": "241582200125392572860052112390930492590"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5bcb44e650bc4ec7eac23df90c5e011a77fa2beb",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-39688-df297bde"
}
]