CVE-2025-68242: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68242 is a Linux kernel vulnerability in the NFS (Network File System) client subsystem where nfs_setattr fails to verify the inode's UID against the caller's filesystem UID (fsuid) when delegated timestamps are enabled. This missing authorization check allows a caller with a mismatched UID to modify file timestamps (atime/mtime) locally without the operation being validated by the NFS server. The vulnerability was published on December 16, 2025, and affects Linux kernel versions starting from commit e12912d94137ab36ee704a91f465ff15c8b423da up to the respective fix commits in stable branches. No CVSS score has been assigned by NVD at this time, and the record is not currently prioritized for NVD enrichment (NVD, Feedly).

The root cause is an improper authorization check (missing UID validation) in the nfs_setattr function within the Linux kernel's NFS client code. When delegated timestamps are permitted for an inode, the kernel allows local modification of atime/mtime metadata without verifying that the caller's fsuid matches the inode's owner UID. This means a process running as an unprivileged user (e.g., 'nobody') can bypass the expected server-side permission check and alter file timestamps on an NFSv4.2 mount. The fix adds an explicit UID comparison; if the caller's fsuid does not match the inode's UID, the setattr request is forwarded to the NFS server for proper authorization. The vulnerability is reproducible using NFSv4.2 mounts with delegated timestamps enabled and the Linux Test Project (LTP) utimes01/utime06 test cases (NVD).

The primary impact is an improper authorization bypass that allows a local or NFS-connected user with a mismatched UID to modify file timestamps (atime and mtime) on NFSv4.2 mounts without server-side permission validation. This affects the integrity of file metadata on NFS-exported filesystems, potentially enabling an attacker to obscure access patterns, manipulate audit trails, or interfere with time-sensitive applications. The confidentiality and availability impacts are minimal; the vulnerability is limited to integrity of timestamp metadata rather than data exfiltration or denial of service (NVD).

The Linux kernel stable branches have been patched with the following fix commits: b2e4cda71ed062c87573b016d2d956a62f4258ed (for one stable branch), 0e9be902041c6b9f0ed4b72764187eed1067a42f, and b623390045a81fc559decb9bfeb79319721d3dfb. Patched versions include Linux 6.12.59, 6.17.9, and 6.18. Administrators should update to a patched kernel version as the primary remediation. As a workaround, disabling NFSv4.2 delegated timestamps (if operationally feasible) would prevent the vulnerable code path from being triggered (NVD, Feedly).