CVE-2025-68803 Details
Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: NFSv4 file creation neglects setting ACL An NFSv4 client that sets an ACL with a named principal during file creation retrieves the ACL afterwards, and finds that it is only a default ACL (based on the mode bits) and not the ACL that was requested during file creation. This violates RFC 8881 section 6.4.1.3: "the ACL attribute is set as given". The issue occurs in nfsd_create_setattr(), which calls nfsd_attrs_valid() to determine whether to call nfsd_setattr(). However, nfsd_attrs_valid() checks only for iattr changes and security labels, but not POSIX ACLs. When only an ACL is present, the function returns false, nfsd_setattr() is skipped, and the POSIX ACL is never applied to the inode. Subsequently, when the client retrieves the ACL, the server finds no POSIX ACL on the inode and returns one generated from the file's mode bits rather than returning the originally-specified ACL.
A vulnerability in the Linux kernel's NFSv4 file creation process has been identified, where Access Control Lists (ACLs) are not properly set. When an NFSv4 client specifies an ACL with a named principal during file creation, the ACL retrieved later is only a default one, based on the mode bits, rather than the one originally requested. This issue, which violates RFC 8881 section 6.4.1.3, arises because the function that validates attributes before setting them only checks certain changes and security labels, but not POSIX ACLs. As a result, when only an ACL is present, the necessary function to apply it is bypassed, leading to the omission of the specified ACL on the inode. Consequently, when the ACL is retrieved, the server generates a default one from the file's mode bits instead of returning the originally specified ACL.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for updating the Linux kernel can be found in the official Linux documentation or through the package management system of the respective Linux distribution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jan 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-019113.html | siemens-SADP | |
| https://git.kernel.org/stable/c/214b396480061cbc8b16f2c518b2add7fbfa5192 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/381261f24f4e4b41521c0e5ef5cc0b9a786a9862 | kernel.org | |
| https://git.kernel.org/stable/c/60dbdef2ebc2317266a385e4debdb1bb0e57afe1 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/75f91534f9acdfef77f8fa094313b7806f801725 | kernel.org | |
| https://git.kernel.org/stable/c/913f7cf77bf14c13cfea70e89bcb6d0b22239562 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/bf4e671c651534a307ab2fabba4926116beef8c3 | kernel.org | Source CodeVendor |
| https://git.kernel.org/stable/c/c182e1e0b7640f6bcc0c5ca8d473f7c57199ea3d | kernel.org |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| Linux kernel | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jul 14, 2026 | CVE Modified | siemens-SADP |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jan 19, 2026 | CVE Modified | kernel.org |
| Jan 17, 2026 | CVE Modified | kernel.org |
| Jan 13, 2026 | New CVE Received | kernel.org |