Junglewise Threat Intelligence

CVE-2025-12801: Linux nfs-utils privilege escalation in rpc.mountd

CVE-2025-12801 · Severity: medium · CVSS 6.5 · Published 2026-03-04

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Linux, Red Hat.

Executive brief

A vulnerability in the Linux Network File System (NFS) service allows authorized users to bypass security restrictions and access files they should not be able to see. Specifically, a user with basic access to a shared folder can gain unauthorized access to any subfolder or file within that share, ignoring standard security settings like 'root_squash'. This could lead to the exposure of sensitive data stored on corporate file servers.

Technical details

A vulnerability exists in the rpc.mountd daemon within the nfs-utils package for Linux. The flaw allows an authenticated NFSv3 client to escalate privileges assigned in the /etc/exports file at mount time. By exploiting this, a client can access any subdirectory or subtree of an exported directory, bypassing file permissions and security attributes such as 'root_squash' or 'all_squash'. The issue is tracked as CWE-732 (Incorrect Permission Assignment) and CWE-279. Patches have been released by Red Hat for RHEL 8, 9, and 10.

Affected products

  • Red Hat Enterprise Linux 8 Fixed in 1:2.3.3-68.el8_10
  • Red Hat Enterprise Linux 9 Fixed in 1:2.5.4-38.el9_7.3
  • Red Hat Enterprise Linux 10 Fixed in 1:2.8.3-0.el10_1.3
  • Linux nfs-utils

Timeline

  • 2026-03-04: disclosed
  • 2026-03-05: patched: Red Hat released security updates (RHSA-2026:3938, RHSA-2026:3939)

References

Related threats