Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0056 44.4 —
AFFECTED Product Versions Fixed Linux 8dd91e8d31febf4d9cca3ae1bb4771d33ae7ee5a – — Linux 6.12 – 6.12.23
TIMELINE Apr 16 Reserved by Linux Apr 18 Published (CNA: Linux) Jul 30 RESCORED — CVE-2025-39688 (Linux). CVSS 7.5 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8 test fails when run against nfsd. It acquires a delegation and then lets the lease time out. It then tries to use the deleg stateid and expects to see NFS4ERR_DELEG_REVOKED, but it gets bad NFS4ERR_BAD_STATEID instead. When a delegation is revoked, it's initially marked with SC_STATUS_REVOKED, or SC_STATUS_ADMIN_REVOKED and later, it's marked with the SC_STATUS_FREEABLE flag, which denotes that it is waiting for s FREE_STATEID call. nfs4_lookup_stateid() accepts a statusmask that includes the status flags that a found stateid is allowed to have. Currently, that mask never includes SC_STATUS_FREEABLE, which means that revoked delegations are (almost) never found. Add SC_STATUS_FREEABLE to the always-allowed status flags, and remove it from nfsd4_delegreturn() since it's now always implied.
| Date | Event | Detail |
|---|---|---|
| April 16, 2025 | Reserved | Reserved by Linux |
| April 18, 2025 | Published | Published (CNA: Linux) |
| July 30, 2026 | RESCORED | RESCORED — CVE-2025-39688 (Linux). CVSS 7.5 → 5.5 (NVD). |
Authoritative record: CVE-2025-39688 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-39688 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.