CVE-2025-68242

A permission checking flaw was found in the NFS client implementation in the Linux kernel. When delegated timestamps are enabled for NFS 4.2, nfs_setattr() fails to verify the inode's UID against the caller's fsuid before allowing timestamp modifications. This allows unprivileged users to modify atime/mtime on files they don't own when timestamp delegation is active.

This affects NFS 4.2 mounts with delegated timestamps enabled. The flaw allows timestamp modification bypass but does not permit reading or writing file contents, limiting the security impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.