CVE-2025-68242 NFS: Fix LTP test failures when timestamps are delegated
A missing UID check in Linux kernel NFS allows low-privileged users to modify file timestamps on delegated inodes, potentially leading to privilege escalation or data integrity issues.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68242?
CVE-2025-68242 is a missing authorization vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix LTP test failures when timestamps are delegated
The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fields using the 'nobody' user ID.
The problem can be reproduced as follow:
# echo "/media *(rw,no_root_squash,sync)" >> /etc/exports # export -ra # mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir # cd /opt/ltp # ./runltp -d /tmpdir -s utimes01 # ./runltp -d /tmpdir -s utime06
This issue occurs because nfs_setattr does not verify the inode's UID against the caller's fsuid when delegated timestamps are permitted for the inode.
This patch adds the UID check and if it does not match then the request is sent to the server for permission checking.
Which versions are affected by CVE-2025-68242?
How do I fix CVE-2025-68242?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-68242 being exploited?
There is no known exploitation of CVE-2025-68242 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68242, DEBIAN-CVE-2025-68242, GHSA-x3jc-4xg9-3pr6, ROOT-OS-DEBIAN-13-CVE-2025-68242, UBUNTU-CVE-2025-68242.