CVE-2025-39688nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()
- 7.5HighCVSS base score
- 0.63%Exploitation in 30 daysEPSS · top 49% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERR_DELEG_REVOKED, but it gets bad NFS4ERR_BAD_STATEID instead. When a delegation is revoked, it's initially marked with SC_STATUS_REVOKED, or SC_STATUS_ADMIN_REVOKED and later, it's marked with the SC_STATUS_FREEABLE flag, which denotes that it is waiting for s FREE_STATEID call. nfs4_lookup_stateid() accepts a statusmask that includes the status flags that a found stateid is allowed to have. Currently, that mask never includes SC_STATUS_FREEABLE, which means that revoked delegations are (almost) never found. Add SC_STATUS_FREEABLE to the always-allowed status flags, and remove it from nfsd4_delegreturn() since it's now always implied.
Timeline
ID reserved
By Linux
- 2 days later
· 2 days later
Published
- 18 months later
· 18 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.63% · top 49% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – < 52e209203c35a4fbff8af23cd3613efe5df40102
- affected 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – < dc6f3295905d7185e71091870119a8c11c3808cc
- affected 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – < 5bcb44e650bc4ec7eac23df90c5e011a77fa2beb
- affected 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – < d1bc15b147d35b4cb7ca99a9a7d79d41ca342c13
- affected 967faa26f313a62e7bebc55d5b8122eaee43b929
- affected 6.11.6 – < 6.12
- affected 6.12
- unaffected < 6.12
- unaffected 6.12.23 – ≤ 6.12.*
- unaffected 6.13.11 – ≤ 6.13.*
- unaffected 6.14.2 – ≤ 6.14.*
- unaffected 6.15 – ≤ *
References
References4
- https://git.kernel.org/stable/c/52e209203c35a4fbff8af23cd3613efe5df40102 (opens in a new tab)
- https://git.kernel.org/stable/c/dc6f3295905d7185e71091870119a8c11c3808cc (opens in a new tab)
- https://git.kernel.org/stable/c/5bcb44e650bc4ec7eac23df90c5e011a77fa2beb (opens in a new tab)
- https://git.kernel.org/stable/c/d1bc15b147d35b4cb7ca99a9a7d79d41ca342c13 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-11820 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-39688)Record last updated .