CVE-2025-68803

A flaw was found in the Linux kernel's NFSv4 server implementation. When an NFSv4 client creates a file and specifies an ACL with named principals, the server fails to apply the requested ACL. The nfsd_create_setattr() function checks only for iattr changes and security labels but not POSIX ACLs, causing the ACL to be silently dropped. The file ends up with a default ACL based on mode bits instead of the client-specified ACL, violating RFC 8881.

This is a functional bug that causes NFSv4 ACLs to not be applied during file creation. While it affects access control expectations, the default mode-based permissions are still applied. The impact is that files may have more permissive or restrictive access than intended by the client-specified ACL. This primarily affects environments relying on named principal ACLs for fine-grained access control.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.