Skip to main content

Linux Kernel CVE-2025-68764

HIGH
2026-01-05 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Local authenticated user (AV:L/PR:L); exploitation needs a specific automount+restrictive-flag configuration (AC:H); primary impact is bypassing noexec/nodev integrity controls (I:H), with limited confidentiality and no direct availability loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 05, 2026 - 10:15 cve.org
HIGH 7.8
CVE Published
Jan 05, 2026 - 10:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags

When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag.

AnalysisAI

Security-flag inheritance bypass in the Linux kernel NFS client allows a low-privileged local user to obtain access on automounted NFS submounts that ignores the restrictive superblock options (ro, noexec, nodev, sync) set on the parent mount. Because automounted filesystems fail to preserve these user-set mount flags, protections such as read-only or no-execute enforcement can be silently dropped on the child mount, undermining the security posture an administrator intended. No public exploit identified at time of analysis, and the EPSS score is negligible (0.05%, 16th percentile), consistent with a local, configuration-dependent defense-in-depth weakness rather than a mass-exploited flaw.

Technical ContextAI

The issue lives in the Linux kernel NFS client's automount path. When a crossed NFS mountpoint (a referral or nested export) is traversed, the kernel creates a new superblock/mount for the target and is supposed to carry over the mount-flag semantics (MS_RDONLY, MS_NOEXEC, MS_NODEV, MS_SYNCHRONOUS) that the user or administrator applied to the parent mount. The fix ensures the automounted filesystem inherits these ro/noexec/nodev/sync flags. The root cause is an improper preservation of security-relevant mount attributes across an automount boundary - conceptually CWE-281/CWE-273 (improper preservation of permissions / insufficient inherited permissions); the input lists CWE as N/A, so this classification is inferred, not vendor-assigned. The affected component is broadly deployed: the Siemens ProductCERT advisory (ssa-019113) indicates the flaw also propagates into embedded/industrial products that ship a Linux kernel.

Affected ProductsAI

The affected product is the mainline/stable Linux kernel NFS client across the branches fixed by the eight referenced git.kernel.org stable commits (4b296944, 612cc986, 8675c698, a3dc6c40, ba1495ae, c09070b4, dce10c59, df9b003a), indicating backports to multiple stable series. Distribution-level exposure is confirmed for Ubuntu via USN-8094-1 and USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1). Siemens industrial products embedding the Linux kernel are also affected per https://cert-portal.siemens.com/productcert/html/ssa-019113.html. No CPE strings were supplied in the input, so exact version ranges are drawn from the distribution advisories rather than NVD CPE data.

RemediationAI

Patch available per vendor advisory: update to a kernel that includes the referenced fix commits. On Ubuntu, apply the packages from USN-8094-1 and USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1) and reboot; on other distributions, pull the stable kernel containing commits such as 4b296944e632 / df9b003a2eca. Siemens deployments should follow ssa-019113 (https://cert-portal.siemens.com/productcert/html/ssa-019113.html). Until patched, where NFS automounts are relied upon as a security boundary, restrict or disable NFS automounting of untrusted exports and explicitly mount sensitive NFS shares with ro,noexec,nodev at the top level so child access cannot silently gain exec/dev capability - the trade-off is loss of dynamic crossed-mount traversal and possible application breakage. Limiting local shell/account access to trusted users also reduces exposure given the local attack vector. Exact upstream released kernel version numbers were not provided in the input and should be confirmed against your distribution's advisory before deployment.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-68764 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy