CVE-2025-68803: Linux Kernel Information Disclosure Flaw

CVE-2025-68803 Overview

A vulnerability has been identified in the Linux kernel's NFSD (Network File System Daemon) component where NFSv4 file creation operations fail to properly apply Access Control Lists (ACLs). When an NFSv4 client sets an ACL with a named principal during file creation, the ACL is not correctly applied to the inode. Instead, only a default ACL based on mode bits is set, causing subsequent ACL retrievals to return an incorrect, mode-based ACL rather than the originally specified one.

Critical Impact

This vulnerability violates RFC 8881 section 6.4.1.3 which requires that "the ACL attribute is set as given" during file creation, potentially leading to improper access control on NFSv4 file systems.

Affected Products

• Linux Kernel (NFSD component)
• NFSv4 server implementations

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68803 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68803

Vulnerability Analysis

This vulnerability represents an Improper Access Control flaw within the Linux kernel's NFSv4 server implementation. The issue stems from incomplete validation logic in the nfsd_create_setattr() function, which fails to recognize POSIX ACLs as valid attributes requiring processing.

When a client creates a file and specifies an ACL with a named principal, the server's nfsd_attrs_valid() function is called to determine whether nfsd_setattr() should be invoked. However, this validation function only checks for iattr changes and security labels, completely ignoring POSIX ACLs. This oversight results in the ACL setting operation being skipped entirely.

The practical consequence is that files created with explicit ACL specifications will not have those ACLs applied. When clients subsequently query the ACL, the server finds no POSIX ACL on the inode and returns a synthetic ACL generated from the file's mode bits, which does not reflect the originally requested access control configuration.

Root Cause

The root cause lies in the nfsd_attrs_valid() function's incomplete attribute checking logic. The function was designed to determine whether nfsd_setattr() should be called during file creation, but it only validates iattr changes and security labels. POSIX ACLs were not included in this validation check, causing the function to return false when only an ACL is present in the creation attributes. This results in nfsd_setattr() being skipped entirely, and the POSIX ACL is never applied to the newly created inode.

Attack Vector

The attack vector for this vulnerability is through NFSv4 file system operations. An attacker or misconfigured system could exploit this behavior to:

1. Create files on an NFSv4 share with the expectation that specific ACL permissions are applied
2. The ACL specifications are silently ignored, resulting in weaker access controls than intended
3. Files may become accessible to users who should have been restricted by the original ACL specification

This vulnerability does not require special privileges beyond normal NFSv4 file creation capabilities, making it a concern for any environment relying on NFSv4 ACLs for access control.

The vulnerability manifests in the NFSD file creation path where ACL attributes are not properly validated. Technical details and the specific code changes can be found in the kernel git commits referenced in the external references.

Detection Methods for CVE-2025-68803

Indicators of Compromise

• Files created on NFSv4 shares have ACLs that differ from those specified during creation
• NFSv4 clients reporting mismatched ACLs after file creation operations
• Unexpected access permissions on files where named principals were specified in ACLs
• Audit logs showing ACL discrepancies between client-requested and server-applied values

Detection Strategies

• Monitor NFSv4 server logs for file creation operations that include ACL specifications
• Implement automated ACL verification checks comparing requested vs. applied ACLs
• Review kernel version to determine if running a vulnerable NFSD implementation
• Use NFS debugging tools to trace nfsd_create_setattr() and nfsd_attrs_valid() function calls

Monitoring Recommendations

• Enable verbose NFS server logging to capture ACL-related operations
• Implement periodic ACL audits on critical NFSv4-mounted file systems
• Set up alerts for ACL mismatches detected during file system integrity checks
• Monitor kernel logs for NFSD-related warnings or errors during file creation

How to Mitigate CVE-2025-68803

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the fix for this vulnerability
• Verify existing file ACLs on NFSv4 shares to identify any improperly configured permissions
• Temporarily apply ACLs manually after file creation until the kernel is patched
• Review access patterns on NFSv4 shares to identify any potential security exposures

Patch Information

The Linux kernel developers have released patches to address this vulnerability. The fix modifies the nfsd_attrs_valid() function to properly check for POSIX ACL attributes in addition to iattr changes and security labels. Multiple patch commits are available:

• Kernel Patch Commit 214b3964
• Kernel Patch Commit 60dbdef2
• Kernel Patch Commit 913f7cf7
• Kernel Patch Commit bf4e671c

Organizations should apply the appropriate patch for their kernel version through their distribution's package management system.

Workarounds

• Apply ACLs using setfacl commands after file creation rather than during the create operation
• Use NFSv3 with traditional Unix permissions if ACLs are not critical for the use case
• Implement a post-creation script or hook to verify and reapply ACLs as needed
• Consider using alternative file sharing protocols that properly enforce ACLs during creation

# Workaround: Manually apply ACL after file creation
# Create file first
touch /nfs/share/newfile.txt

# Then apply the intended ACL
setfacl -m u:username:rwx /nfs/share/newfile.txt

# Verify the ACL was applied correctly
getfacl /nfs/share/newfile.txt