CVE-2025-68764 NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
Automounted NFS filesystems fail to inherit security flags like noexec, allowing execution of binaries on read-only mounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68764?
CVE-2025-68764 is a high-severity vulnerability in Linux, published on 5 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag.
Weakness: CWE-862
Which versions are affected by CVE-2025-68764?
How do I fix CVE-2025-68764?
Apply the vendor's patch.
Is CVE-2025-68764 being exploited?
There is no known exploitation of CVE-2025-68764 in the wild and no public exploit code.
Sources
Also known as AZL-73394, BELL-CVE-2025-68764, DEBIAN-CVE-2025-68764, GHSA-6pgh-g35q-vvjg, ROOT-OS-DEBIAN-11-CVE-2025-68764, ROOT-OS-DEBIAN-12-CVE-2025-68764 and 4 more.