CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
In the Linux kernel, the following vulnerability has been resolved:
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For automounted NFS filesystems, ensure mount options inherit the user-set superblock mount flags such as "ro" (and preserve ro,noexec,nodev,sync) when performing the automount.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68764?
The severity of CVE-2025-68764 is rated as medium due to the potential for improper filesystem inheritance leading to security concerns.
How do I fix CVE-2025-68764?
To fix CVE-2025-68764, update to the latest version of the Linux kernel where this vulnerability has been patched.
What systems are affected by CVE-2025-68764?
CVE-2025-68764 affects systems running the Linux kernel that utilize NFS automounted filesystems.
What are the potential risks of CVE-2025-68764?
The risks of CVE-2025-68764 include unauthorized access to sensitive data and the possibility of executing malicious code if filesystem flags are not respected.
When was CVE-2025-68764 disclosed?
CVE-2025-68764 was disclosed in 2025, bringing attention to critical issues with automounted filesystem configurations in the Linux kernel.