CVE-2025-68764

NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags

State: Published
Severity: 7.8 High
Published: Jan 5, 2026
Updated: Oct 19, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags

When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
LinuxLinux	f2aedb713c284429987dc66c7aaf38decfc8da2a to before a3dc6c40bcab1a888d5c0d134ccc0746b4c98929Affected f2aedb713c284429987dc66c7aaf38decfc8da2a to before ba1495aefd22fcf0746a2a3025c95d766d7cde4dAffected f2aedb713c284429987dc66c7aaf38decfc8da2a to before c09070b4def1b34e473a746c6a5331ccb80902c1Affected f2aedb713c284429987dc66c7aaf38decfc8da2a to before dce10c59211e5cd763a62ea01e79b82a629811e3Affected f2aedb713c284429987dc66c7aaf38decfc8da2a to before 612cc98698d667df804792f0c47d4e501e66da29Affected f2aedb713c284429987dc66c7aaf38decfc8da2a to before 4b296944e632cf4c6a4cc8e2585c6451eae47b1bAffected f2aedb713c284429987dc66c7aaf38decfc8da2a to before df9b003a2ecacc7218486fbb31fe008c93097d5fAffected f2aedb713c284429987dc66c7aaf38decfc8da2a to before 8675c69816e4276b979ff475ee5fac4688f80125Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.63 through 6.12.Not affected 6.17.13 through 6.17.Not affected 6.18.2 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

f2aedb713c284429987dc66c7aaf38decfc8da2a to before a3dc6c40bcab1a888d5c0d134ccc0746b4c98929Affected
f2aedb713c284429987dc66c7aaf38decfc8da2a to before ba1495aefd22fcf0746a2a3025c95d766d7cde4dAffected
f2aedb713c284429987dc66c7aaf38decfc8da2a to before c09070b4def1b34e473a746c6a5331ccb80902c1Affected
f2aedb713c284429987dc66c7aaf38decfc8da2a to before dce10c59211e5cd763a62ea01e79b82a629811e3Affected
f2aedb713c284429987dc66c7aaf38decfc8da2a to before 612cc98698d667df804792f0c47d4e501e66da29Affected
f2aedb713c284429987dc66c7aaf38decfc8da2a to before 4b296944e632cf4c6a4cc8e2585c6451eae47b1bAffected
f2aedb713c284429987dc66c7aaf38decfc8da2a to before df9b003a2ecacc7218486fbb31fe008c93097d5fAffected
f2aedb713c284429987dc66c7aaf38decfc8da2a to before 8675c69816e4276b979ff475ee5fac4688f80125Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.63 through 6.12.*Not affected
6.17.13 through 6.17.*Not affected
6.18.2 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.