Skip to main content

Linux Kernel CVE-2025-68243

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.0
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.3 MEDIUM

Local low-priv mount access in a non-default TLS X.509 NFS config with identity-collision timing gives AV:L/AC:H/PR:L; identity crossover breaks confidentiality and integrity but has no real availability impact, so A:N.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
4.7 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:18 vuln.today
CVE Published
Dec 16, 2025 - 15:15 cve.org
HIGH 7.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFS: Check the TLS certificate fields in nfs_match_client()

If the TLS security policy is of type RPC_XPRTSEC_TLS_X509, then the cert_serial and privkey_serial fields need to match as well since they define the client's identity, as presented to the server.

AnalysisAI

Client-identity confusion in the Linux kernel's NFS client allows a low-privileged local user to have an NFS mount silently reuse an existing RPC connection established under a different TLS X.509 client certificate. Because nfs_match_client() failed to compare the cert_serial and privkey_serial fields that define the client's presented identity, a mount intended to use one certificate could be bound to a connection authenticated with another, enabling access to data under the wrong identity. This is an information-disclosure/identity-mismatch flaw (CVSS 7.0); it is not in CISA KEV, has no public exploit identified at time of analysis, and carries a very low EPSS score of 0.10% (1st percentile).

Technical ContextAI

The issue lives in the kernel's NFS/SUNRPC transport-security layer, specifically the RPC_XPRTSEC_TLS_X509 mode, which provides mutual TLS authentication for NFS-over-TLS where the client presents an X.509 certificate to prove its identity to the server. To avoid opening redundant transports, the NFS client calls nfs_match_client() to find and reuse an existing nfs_client that matches a new mount request. The defect is that this matching routine did not include the cert_serial and privkey_serial fields - the serial numbers identifying the client certificate and private key that constitute the client's authenticated identity. The root-cause class is incorrect equivalence/authorization checking during connection reuse (conceptually CWE-863 incorrect authorization / CWE-295 improper certificate identity handling), even though the NVD lists CWE as N/A. As a result the caching logic could treat two cryptographically distinct client identities as interchangeable.

Affected ProductsAI

The affected product is the Linux kernel's NFS client (SUNRPC/NFS-over-TLS subsystem), only when built and configured to use TLS mutual authentication with X.509 client certificates (RPC_XPRTSEC_TLS_X509). No specific fixed kernel version or stable release tag is provided in the input; the two references are stable-tree commit hashes at git.kernel.org (b8fa37219074811c04d4ecb742c73e2b296da6a8 and fb2cba0854a7f315c8100a807a6959b99d72479e). No CPE strings and no distribution advisory were supplied, so exact affected version ranges cannot be enumerated from the available data and should be confirmed against each distribution's kernel changelog.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that incorporates commits b8fa37219074811c04d4ecb742c73e2b296da6a8 and fb2cba0854a7f315c8100a807a6959b99d72479e (https://git.kernel.org/stable/c/b8fa37219074811c04d4ecb742c73e2b296da6a8 and https://git.kernel.org/stable/c/fb2cba0854a7f315c8100a807a6959b99d72479e), which make nfs_match_client() also compare cert_serial and privkey_serial so connections are only reused for matching client identities. Track your distribution's stable kernel release notes for the tagged version that backports these commits. Until patched, the most direct compensating control is to avoid depending on client-certificate isolation via connection reuse: refrain from mounting the same server with multiple distinct X.509 client identities from one host, or disable RPC_XPRTSEC_TLS_X509 mutual-auth NFS mounts where feasible (trade-off: loses mutual TLS authentication, so only acceptable on trusted networks). Given the local, low-privilege attack surface, also restrict which users can perform NFS mounts on multi-tenant hosts.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68243 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy