The vulnerability CVE-2025-68803 in the Linux kernel's NFSD component affects NFSv4 file creation. Specifically, when a client sets an ACL with a named principal during file creation, the server fails to apply the POSIX ACL to the inode. This occurs because nfsd_create_setattr() calls nfsd_attrs_valid() to decide whether to invoke nfsd_setattr(), but nfsd_attrs_valid() does not consider POSIX ACL changes as valid attributes to trigger nfsd_setattr(). Consequently, the ACL is never applied, and subsequent ACL retrieval returns a default ACL based on mode bits rather than the client-specified ACL, violating RFC 8881 requirements.

Clients setting ACLs with named principals during NFSv4 file creation do not have their ACLs correctly applied on the server. This results in the server returning default ACLs instead of the intended ones, potentially causing incorrect access control enforcement. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H), meaning unauthorized access or modification and denial of service could occur due to improper ACL handling.

A fix for this vulnerability has been resolved in the Linux kernel. Since no explicit patch links or vendor advisory details are provided, users should update to the latest Linux kernel versions where this issue is addressed. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or distribution security updates for the relevant fixed versions and apply those updates to ensure the ACL setting behavior complies with RFC 8881.