CVE-2025-39688

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-39688

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERR_DELEG_REVOKED, but it gets bad NFS4ERR_BAD_STATEID instead. When a delegation is revoked, it's initially marked with SC_STATUS_REVOKED, or SC_STATUS_ADMIN_REVOKED and later, it's marked with the SC_STATUS_FREEABLE flag, which denotes that it is waiting for s FREE_STATEID call. nfs4_lookup_stateid() accepts a statusmask that includes the status flags that a found stateid is allowed to have. Currently, that mask never includes SC_STATUS_FREEABLE, which means that revoked delegations are (almost) never found. Add SC_STATUS_FREEABLE to the always-allowed status flags, and remove it from nfsd4_delegreturn() since it's now always implied.

References
Link Resource
https://git.kernel.org/stable/c/52e209203c35a4fbff8af23cd3613efe5df40102 Patch
https://git.kernel.org/stable/c/5bcb44e650bc4ec7eac23df90c5e011a77fa2beb Patch
https://git.kernel.org/stable/c/d1bc15b147d35b4cb7ca99a9a7d79d41ca342c13 Patch
https://git.kernel.org/stable/c/dc6f3295905d7185e71091870119a8c11c3808cc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*
History

06 Nov 2025, 21:34

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
CWE NVD-CWE-noinfo
References () https://git.kernel.org/stable/c/52e209203c35a4fbff8af23cd3613efe5df40102 - () https://git.kernel.org/stable/c/52e209203c35a4fbff8af23cd3613efe5df40102 - Patch
References () https://git.kernel.org/stable/c/5bcb44e650bc4ec7eac23df90c5e011a77fa2beb - () https://git.kernel.org/stable/c/5bcb44e650bc4ec7eac23df90c5e011a77fa2beb - Patch
References () https://git.kernel.org/stable/c/d1bc15b147d35b4cb7ca99a9a7d79d41ca342c13 - () https://git.kernel.org/stable/c/d1bc15b147d35b4cb7ca99a9a7d79d41ca342c13 - Patch
References () https://git.kernel.org/stable/c/dc6f3295905d7185e71091870119a8c11c3808cc - () https://git.kernel.org/stable/c/dc6f3295905d7185e71091870119a8c11c3808cc - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: permite SC_STATUS_FREEABLE al buscar mediante nfs4_lookup_stateid() La prueba pynfs DELEG8 falla cuando se ejecuta contra nfsd. Adquiere una delegación y luego deja que se agote el tiempo de concesión. Luego intenta usar el stateid de la deleg y espera ver NFS4ERR_DELEG_REVOKED, pero en su lugar obtiene NFS4ERR_BAD_STATEID incorrecto. Cuando se revoca una delegación, inicialmente se marca con SC_STATUS_REVOKED o SC_STATUS_ADMIN_REVOKED y, más tarde, se marca con el indicador SC_STATUS_FREEABLE, que indica que está esperando una llamada FREE_STATEID. nfs4_lookup_stateid() acepta una máscara de estado que incluye los indicadores de estado que se permite que tenga un stateid encontrado. Actualmente, esa máscara nunca incluye SC_STATUS_FREEABLE, lo que significa que las delegaciones revocadas (casi) nunca se encuentran. Agregue SC_STATUS_FREEABLE a los indicadores de estado siempre permitidos y elimínelo de nfsd4_delegreturn(), ya que ahora siempre está implícito.

18 Apr 2025, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-18 07:15

Updated : 2025-11-06 21:34

NVD link : CVE-2025-39688

Mitre link : CVE-2025-39688

CVE.ORG link : CVE-2025-39688

JSON object : View

Products Affected

linux

CWE
NVD-CWE-noinfo