Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) component could allow filesystems to be mounted without their intended security restrictions. When a system automatically connects to a network drive, it may fail to apply 'read-only' or 'no-execution' rules set by the administrator. This could potentially allow unauthorized changes to data or the execution of malicious programs on what should have been a restricted connection.
Technical details
A vulnerability exists in the Linux kernel NFS client where automounted filesystems fail to inherit critical superblock mount flags (ro, noexec, nodev, sync) from the parent mount. The issue stems from the transition to the fs_context API, where the nfs_d_automount function in fs/nfs/namespace.c did not correctly propagate the user-defined security flags to the new mount context. An attacker with local access could potentially exploit this to write to a filesystem intended to be read-only or execute binaries on a mount intended to be noexec. The fix ensures that flags covered by NFS_SB_MASK are explicitly inherited during the automount process.
Affected products
- Linux Linux Kernel f2aedb713c28 to a3dc6c40bcab1a888d5c0d134ccc0746b4c98929
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and later
Timeline
- 2025-11-28: disclosed: Initial patch authored by Trond Myklebust
- 2025-12-18: patched: Patch committed to Linux stable tree
- 2026-01-05: advisory: CVE published
References
- https://git.kernel.org/stable/c/4b296944e632cf4c6a4cc8e2585c6451eae47b1b
- https://git.kernel.org/stable/c/612cc98698d667df804792f0c47d4e501e66da29
- https://git.kernel.org/stable/c/8675c69816e4276b979ff475ee5fac4688f80125
- https://git.kernel.org/stable/c/a3dc6c40bcab1a888d5c0d134ccc0746b4c98929
- https://git.kernel.org/stable/c/ba1495aefd22fcf0746a2a3025c95d766d7cde4d
- https://git.kernel.org/stable/c/c09070b4def1b34e473a746c6a5331ccb80902c1
- https://git.kernel.org/stable/c/dce10c59211e5cd763a62ea01e79b82a629811e3