CVE-2025-68803 Linux CVE debrief

Who should care

System administrators and users of Linux kernel-based systems who use NFSv4 protocol for file sharing should be aware of this vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability is caused by the nfsd_create_setattr() function calling nfsd_attrs_valid() to determine whether to call nfsd_setattr(). However, nfsd_attrs_valid() checks only for iattr changes and security labels, but not POSIX ACLs. When only an ACL is present, the function returns false, nfsd_setattr() is skipped, and the POSIX ACL is never applied to the inode. The fix involves modifying the nfsd_create_setattr() function to properly handle POSIX ACLs.

Defensive priority

High

Recommended defensive actions

• Apply the patch provided by the Linux kernel maintainers
• Verify and update the Linux kernel to the latest version
• Monitor NFSv4 file creation and ACL settings
• Implement compensating controls to ensure ACLs are properly applied
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by the Linux kernel maintainers. The fix involves modifying the nfsd_create_setattr() function to properly handle POSIX ACLs. Evidence of the fix can be found in the official Linux kernel repository. The vulnerability was made public on 2026-01-13T16:16:02.377Z. Defenders should verify the patch and update their Linux kernel to the latest version. Additional information can be found in the CVE record and NVD detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.