CVE-2025-68242

In the Linux kernel, NFS delegated timestamps permit clients to modify file atime and mtime locally without contacting the server. The nfs_setattr function failed to verify that the caller's filesystem UID matched the inode's UID before accepting the delegated timestamp update. This omission allowed users with access to a delegated file to arbitrarily change its timestamps, even if they lacked ownership permissions.

To trigger the vulnerability, an attacker needs network access to an NFS share that enables delegated timestamps (e.g., NFSv4.2 with no_root_squash). The LTP tests utimes01 and utime06 reproduce the issue using the nobody user, confirming exploitation privileges. No authentication bypass is required; the flaw lies in the client-side permission check.

The impact is limited to timestamp manipulation, but this can break time-based access controls or logging mechanisms. The fix adds a UID comparison: if the caller's fsuid does not match the inode owner, the request is forwarded to the NFS server for authorization, restoring proper permission validation [1].

The kernel upstream commit resolves the issue, and distributions incorporating the patch are considered fixed. No workaround exists aside from disabling delegated timestamps, which may impact performance. The vulnerability is not known to be exploited in the wild (no KEV listing).