CVE-2025-68243: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68243 is a vulnerability in the Linux kernel's NFS (Network File System) client subsystem, specifically in the nfs_match_client() function. The flaw occurs when the TLS security policy is of type RPC_XPRTSEC_TLS_X509: the cert_serial and privkey_serial fields — which define the client's identity as presented to the server — are not checked during client matching, potentially allowing incorrect client identity association. It was published on December 16, 2025, and affects Linux kernel versions in the range 90c9550a8d65fb9b1bf87baf97a04ed91bf61b33 up to the patched commits. No CVSS score has been assigned by NVD at this time; the EPSS score is approximately 0.011% (CVE Record, Feedly).

The root cause is an incomplete equality check in the nfs_match_client() function within the Linux kernel's NFS subsystem. When TLS mutual authentication via X.509 certificates (RPC_XPRTSEC_TLS_X509) is configured, the function fails to compare the cert_serial and privkey_serial fields, which uniquely identify the client certificate and private key pair used for the TLS session. This means two NFS clients with different X.509 identities could be incorrectly matched as the same client, potentially causing one client to reuse another's established connection. No CWE classification has been formally assigned by NVD. The fix is available in kernel commits b8fa37219074811c04d4ecb742c73e2b296da6a8 and fb2cba0854a7f315c8100a807a6959b99d72479e (kernel.org patch 1, kernel.org patch 2).

Exploitation of this vulnerability could result in incorrect client identity resolution when multiple NFS clients with different X.509 TLS certificates connect to the same server. This may allow one client to inadvertently reuse another client's NFS connection, potentially leading to unauthorized access to file system resources, data exposure, or integrity violations in environments relying on per-client TLS certificate-based authentication. The impact is primarily relevant to multi-tenant or security-sensitive NFS deployments using RPC_XPRTSEC_TLS_X509 (CVE Record).

The vulnerability is resolved in Linux kernel versions 6.17.9 and 6.18, as well as in the stable branch commits b8fa37219074811c04d4ecb742c73e2b296da6a8 and fb2cba0854a7f315c8100a807a6959b99d72479e. Administrators should update to a patched kernel version as soon as it is available for their distribution. As a workaround, environments not using RPC_XPRTSEC_TLS_X509 for NFS are not affected and require no immediate action (kernel.org patch 1, kernel.org patch 2).