Riskcovery

CVE-2025-68242

NFS: Fix LTP test failures when timestamps are delegated

State
Published
Severity
Not scored
Published
Dec 16, 2025
Updated
May 11, 2026
Reserved
Dec 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix LTP test failures when timestamps are delegated

The utimes01 and utime06 tests fail when delegated timestamps are enabled, specifically in subtests that modify the atime and mtime fields using the 'nobody' user ID.

The problem can be reproduced as follow:

# echo "/media *(rw,no_root_squash,sync)" >> /etc/exports # export -ra # mount -o rw,nfsvers=4.2 127.0.0.1:/media /tmpdir # cd /opt/ltp # ./runltp -d /tmpdir -s utimes01 # ./runltp -d /tmpdir -s utime06

This issue occurs because nfs_setattr does not verify the inode's UID against the caller's fsuid when delegated timestamps are permitted for the inode.

This patch adds the UID check and if it does not match then the request is sent to the server for permission checking.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e12912d94137ab36ee704a91f465ff15c8b423da to before b2e4cda71ed062c87573b016d2d956a62f4258edAffected
  • e12912d94137ab36ee704a91f465ff15c8b423da to before 0e9be902041c6b9f0ed4b72764187eed1067a42fAffected
  • e12912d94137ab36ee704a91f465ff15c8b423da to before b623390045a81fc559decb9bfeb79319721d3dfbAffected
LinuxLinux
  • 6.11Affected
  • before 6.11Not affected
  • 6.12.59 through 6.12.*Not affected
  • 6.17.9 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.