CVE-2025-39688

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()

The pynfs DELEG8 test fails when run against nfsd. It acquires a

delegation and then lets the lease time out. It then tries to use the

deleg stateid and expects to see NFS4ERR_DELEG_REVOKED, but it gets

bad NFS4ERR_BAD_STATEID instead.

When a delegation is revoked, it's initially marked with

SC_STATUS_REVOKED, or SC_STATUS_ADMIN_REVOKED and later, it's marked

with the SC_STATUS_FREEABLE flag, which denotes that it is waiting for

s FREE_STATEID call.

nfs4_lookup_stateid() accepts a statusmask that includes the status

flags that a found stateid is allowed to have. Currently, that mask

never includes SC_STATUS_FREEABLE, which means that revoked delegations

are (almost) never found.

Add SC_STATUS_FREEABLE to the always-allowed status flags, and remove it

from nfsd4_delegreturn() since it's now always implied.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References