Executive brief
A vulnerability was identified in the Linux kernel's Network File System (NFS) component, which handles how computers share files over a network. The system failed to properly verify unique security certificate details when matching client connections using TLS encryption. This could potentially allow an unauthorized user to misidentify themselves as a different client, leading to unauthorized data access or modification.
Technical details
A flaw was discovered in the nfs_match_client() function within fs/nfs/client.c of the Linux kernel. When the TLS security policy is set to RPC_XPRTSEC_TLS_X509, the kernel failed to compare the cert_serial and privkey_serial fields. This omission means the kernel could incorrectly reuse an existing client structure for a new connection even if the identities (defined by the certificates) differ. An attacker with local access could potentially exploit this logic error to bypass intended identity isolation between different NFS mounts. The issue has been resolved by adding explicit checks for certificate and private key serial numbers during the client matching process.
Affected products
- Linux Linux Kernel 6.17 to 6.17.8
Timeline
- 2025-10-18: disclosed: Initial patch authored
- 2025-11-24: patched: Patch committed to stable tree
- 2025-12-16: advisory: CVE published