Vulnerability Description
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Openshift Container Platform | 4.0 |
| Redhat | Enterprise Linux | 6.0 |
| Linux-Nfs | Nfs-Utils | - |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:3938Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:3939Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:3940Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:3941Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:3942Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:5127
- https://access.redhat.com/errata/RHSA-2026:5606
- https://access.redhat.com/errata/RHSA-2026:5867
- https://access.redhat.com/errata/RHSA-2026:5873
- https://access.redhat.com/errata/RHSA-2026:5877
- https://access.redhat.com/security/cve/CVE-2025-12801Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2413081Issue TrackingThird Party Advisory
FAQ
What is CVE-2025-12801?
CVE-2025-12801 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mo...
How severe is CVE-2025-12801?
CVE-2025-12801 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-12801?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Openshift Container Platform, Redhat Enterprise Linux, Linux-Nfs Nfs-Utils.