CVE-2025-68803

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: NFSv4 file creation neglects setting ACL

An NFSv4 client that sets an ACL with a named principal during file

creation retrieves the ACL afterwards, and finds that it is only a

default ACL (based on the mode bits) and not the ACL that was

requested during file creation. This violates RFC 8881 section

6.4.1.3: "the ACL attribute is set as given".

The issue occurs in nfsd_create_setattr(), which calls

nfsd_attrs_valid() to determine whether to call nfsd_setattr().

However, nfsd_attrs_valid() checks only for iattr changes and

security labels, but not POSIX ACLs. When only an ACL is present,

the function returns false, nfsd_setattr() is skipped, and the

POSIX ACL is never applied to the inode.

Subsequently, when the client retrieves the ACL, the server finds

no POSIX ACL on the inode and returns one generated from the file's

mode bits rather than returning the originally-specified ACL.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References