CVE-2025-68803: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68803 is a Linux kernel vulnerability in the NFSv4 server (NFSD) subsystem where POSIX Access Control Lists (ACLs) with named principals are silently dropped during file creation, violating RFC 8881 section 6.4.1.3. The flaw was published on January 13, 2026, and affects Linux kernel versions from 6.0 up to the patched stable releases (6.1.160, 6.12.64, 6.18.3, and 6.19-rc3). Microsoft's Azure Linux 3 kernel (version 6.6.119.3-3) is also affected. It carries a CVSS v3.1 base score of 5.5 (Medium) with a local attack vector (Feedly, Red Hat CVE).

The root cause lies in the nfsd_create_setattr() function, which calls nfsd_attrs_valid() to decide whether to invoke nfsd_setattr() for newly created files. The nfsd_attrs_valid() function only checks for iattr (standard attribute) changes and security labels, but does not account for POSIX ACLs (CWE classification not formally assigned). When a client specifies only an ACL with named principals during file creation — without any other attribute changes — nfsd_attrs_valid() incorrectly returns false, causing nfsd_setattr() to be skipped entirely and the POSIX ACL to never be written to the inode. Subsequent ACL retrieval by the client returns a synthesized ACL derived from the file's mode bits rather than the originally requested ACL (Feedly, kernel.org patches).

The primary impact is an integrity failure in access control enforcement on NFS-based storage environments: intended ACL restrictions with named principals are silently not applied, meaning files may be accessible to users or principals who should be denied access. A low-privileged local user on an NFSv4 client could exploit this to gain unauthorized read or write access to files where ACLs were intended to restrict permissions. There is no confidentiality or availability impact directly, but the bypass of intended access controls could facilitate unauthorized data access or modification in multi-tenant or shared NFS environments (Feedly).

1. Identify a vulnerable NFS environment: Confirm the NFS server is running a vulnerable Linux kernel version (6.0 through pre-patch versions of 6.1.160, 6.12.64, 6.18.3) with NFSv4 enabled and POSIX ACL support active on the underlying filesystem.
2. Obtain low-privileged access: Gain local user access on an NFSv4 client that has mount access to the target NFS share.
3. Create a file with a named-principal ACL: Use an NFSv4-aware tool (e.g., nfs4_setfacl) to create a new file while specifying an ACL with a named principal intended to restrict access (e.g., nfs4_setfacl -a 'A::restricteduser@domain:r' newfile).
4. Verify ACL bypass: Retrieve the ACL of the newly created file using nfs4_getfacl newfile or getfacl newfile; observe that the returned ACL is derived from mode bits only, not the specified named-principal ACL.
5. Access restricted file: As the principal that should have been denied, attempt to access the file and confirm that the intended ACL restriction is not enforced, achieving unauthorized access (Feedly).

Apply the available kernel patches that fix the nfsd_attrs_valid() function to correctly recognize POSIX ACLs during file creation. Fixed versions include Linux kernel 6.1.160, 6.12.64, 6.18.3, and 6.19-rc3; Microsoft has released a fix for Azure Linux 3 in kernel version 6.6.119.3-3. Distributions including Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1, USN-8278-1, USN-8278-2, USN-8289-1, USN-8296-1, USN-8296-2), Debian (DSA-6126-1, DLA-4475-1), SUSE, Oracle Linux, and Amazon Linux 2 have issued advisories. As a temporary workaround, administrators can avoid relying solely on named-principal ACLs during file creation on NFSv4 shares, or set ACLs in a separate operation after file creation (Feedly, Ubuntu USN-8177-1, Debian LTS).

Red Hat has acknowledged the vulnerability and published a CVE advisory page. Multiple Linux distributions (Ubuntu, Debian, SUSE, Oracle Linux, Amazon Linux) have issued security advisories and kernel updates addressing this flaw. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability, consistent with its medium severity and lack of active exploitation (Red Hat CVE, Ubuntu USN-8177-1).