Linux Kernel Vulnerability in NFS Daemon Affecting nfs4_lookup_stateid()

CVE-2025-39688

Summary

A vulnerability in the Linux kernel's NFS daemon affects the nfs4_lookup_stateid() function related to stateid management. When a delegation is revoked, it is marked as SC_STATUS_REVOKED or SC_STATUS_ADMIN_REVOKED, and later as SC_STATUS_FREEABLE, indicating it's awaiting a FREE_STATEID call. The current implementation does not account for SC_STATUS_FREEABLE in the status mask for looking up revoked delegations, which leads to the generation of incorrect errors such as NFS4ERR_BAD_STATEID rather than the expected NFS4ERR_DELEG_REVOKED. This flaw impacts the reliability of delegation handling in NFS transactions.

References