CVE-2025-68803

What it actually does

NFSv4 file creation in nfsd_create_setattr skips nfsd_setattr when only a POSIX ACL is supplied because nfsd_attrs_valid checks solely for iattr changes and security labels, leaving the requested ACL unapplied to the inode so that subsequent getattr returns a mode-bit-derived default ACL instead of the one specified by the client.

Why it matters to the business

Linux servers exporting NFSv4 shares may silently apply incorrect file permissions on creation, increasing the risk of unintended data exposure or access-control violations for organizations relying on named-principal ACLs.

How an attack unfolds

An NFSv4 client issues a CREATE operation that includes a POSIX ACL containing a named principal; the server’s nfsd_attrs_valid test returns false, nfsd_setattr is bypassed, the ACL is never written, and later ACL retrieval returns only the default derived from mode bits, violating the client’s expectation that the supplied ACL is stored verbatim.

How to fix it

Upgrade the Linux kernel to a fixed release such as 5.10.248 or apply commit c182e1e0b7640f6bcc0c5ca8d473f7c57199ea3d (and equivalent backports) on all affected stable trees; rebuild and reboot NFS servers, then verify the patch is active before re-exporting shares.

How to confirm the fix worked

Confirm the running kernel contains the fix (uname -r or rpm -q kernel), create a test file via NFSv4 while supplying a named-principal ACL, retrieve the ACL, and verify the exact ACL is stored rather than a mode-derived default.

Typical attack path

1. Establish NFSv4 mount to a vulnerable Linux server
2. Issue CREATE with a POSIX ACL specifying a named principal
3. Observe that subsequent GETATTR or GETACL returns only a mode-derived default ACL
4. Access or modify the file under permissions that differ from the intended ACL

How to detect it

Review NFS server logs (nfsd, rpc.mountd) for CREATE operations accompanied by ACL attributes, correlate with subsequent GETACL replies that contain only mode-derived entries, and inspect kernel version strings on NFS servers for the presence of the listed fixed commits.

What your security team should do

• Prioritize kernel updates on all NFSv4-exporting systems within the next maintenance window
• Temporarily restrict NFSv4 ACL usage or fall back to mode-bit permissions until patches are applied
• Add kernel version checks to configuration-management and vulnerability-scanning pipelines
• Review NFS share exports and client ACL expectations for compliance impact