CVE-2025-68243: NFS: Check the TLS certificate fields in nfs_match_client()
In the Linux kernel, the following vulnerability has been resolved:
NFS: Check the TLS certificate fields in nfsmatchclient()
If the TLS security policy is of type RPCXPRTSECTLSX509, then the certserial and privkeyserial fields need to match as well since they define the client's identity, as presented to the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure TLS security policy of type RPC_XPRTSEC_TLS_X509 validates both cert_serial and privkey_serial fields in nfs_match_client(), requiring they match so they consistently define the client's identity presented to the server.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68243?
CVE-2025-68243 has been classified with a high severity due to potential impacts on TLS certificate validation.
How do I fix CVE-2025-68243?
To fix CVE-2025-68243, update your Linux kernel to the patched version provided by your distribution.
What are the risks of not addressing CVE-2025-68243?
Failing to address CVE-2025-68243 may expose systems to risks associated with improper TLS certificate validation.
Which versions of the Linux kernel are affected by CVE-2025-68243?
All versions prior to the patch release are vulnerable to CVE-2025-68243.
What components are involved in CVE-2025-68243?
CVE-2025-68243 involves the NFS subsystem and TLS certificate management within the Linux kernel.