CVE-2025-68803

Root

Cause

In the Linux kernel's NFS server (NFSD), the function nfsd_create_setattr() is responsible for applying attributes during NFSv4 file creation. It calls nfsd_attrs_valid() to decide whether to invoke nfsd_setattr(). However, nfsd_attrs_valid() only checks for iattr changes and security labels, not for POSIX ACLs. When a client creates a file with only an ACL (no other attribute changes), the function returns false, causing nfsd_setattr() to be skipped. Consequently, the requested POSIX ACL is never applied to the inode [1].

Exploitation

An NFSv4 client that sets an ACL containing a named principal during file creation will later retrieve the ACL and find only a default ACL derived from the file's mode bits, not the ACL that was originally specified. This behavior violates RFC 8881 section 6. No special privileges are required beyond the ability to create files with ACLs; the attack surface is the NFS server's handling of create operations [1].

Impact

The impact is a violation of the NFSv4 protocol specification: the server does not honor the ACL attribute set during file creation. Clients expecting fine-grained access control via ACLs may experience incorrect permissions, potentially leading to unintended access or denial of service. The server returns a mode-based ACL instead of the intended one [1].

Mitigation

The fix is included in Linux kernel stable updates. The commit 381261f24f4e (and backport c182e1e0b76) modifies nfsd_attrs_valid() to also check for POSIX ACL changes, ensuring that nfsd_setattr() is called when an ACL is present. Administrators should apply the latest kernel updates from their distribution [1][2].