CVE-2025-12801
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability was discovered in the rpc.mountd daemon of the nfs-utils package for Linux, allowing an NFSv3 client to escalate privileges assigned in the /etc/exports file at mount time. This enables access to any subdirectory or subtree of an exported directory, regardless of file permissions and 'root_squash' or 'all_squash' attributes.
Risk Assessment
The organization is at risk of unauthorized access to sensitive data by an NFSv3 client that can bypass access restrictions and gain privileges to subdirectories of the exported filesystem, potentially leading to data leakage or integrity compromise.
Recommendation
Immediately update the nfs-utils package to the latest version containing the security fix. Until the update is applied, restrict access to NFSv3 services or implement additional firewall rules.
Other vulnerabilities in nfs-utils
See all- CVE-2026-89096Medium
A flaw was found in nfs-utils where an unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth.
- CVE-2026-89098Medium
A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.
Original NVD description (English source)
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS