CVE-2025-12801: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-12801 is a privilege escalation vulnerability in the rpc.mountd daemon within the nfs-utils package for Linux. It allows an NFSv3 client to bypass the access restrictions defined in /etc/exports at mount time, enabling it to access any subdirectory or subtree of an exported directory regardless of file permissions or root_squash/all_squash attributes. The vulnerability affects the nfs-utils package across Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4.x and IBM Db2 on Cloud Pak for Data. It was first reported on November 6, 2025, and publicly disclosed on March 4, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified under CWE-279 (Incorrect Execution-Assigned Permissions) and CWE-732 (Incorrect Permission Assignment for Critical Resource). The rpc.mountd daemon, which handles NFSv3 mount requests, incorrectly processes client-supplied mount paths, allowing a client to request and gain access to subdirectories or subtrees of an exported directory that were not explicitly authorized in /etc/exports. This means that even if an export is configured with restrictive options such as root_squash or all_squash, a low-privileged network client can circumvent these controls at mount time. The upstream fix was discussed on the linux-nfs mailing list (linux-nfs post) and referenced in the Red Hat Bugzilla entry (Red Hat Bugzilla).

Successful exploitation allows a low-privileged NFSv3 client with network access to read sensitive data from any subdirectory or subtree of an NFS-exported directory, bypassing both filesystem permissions and squash-based access controls. The primary impact is a high confidentiality breach — an attacker can access files they should not be permitted to read, including potentially sensitive configuration files, credentials, or application data stored under exported paths. Integrity and availability are not directly impacted by this vulnerability. In environments where NFS shares are used for shared storage across multiple systems, exploitation could facilitate lateral movement or information gathering to support further attacks (Red Hat CVE, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of this report. The vulnerability requires low-level network privileges — the attacker must be an NFSv3 client with at least some level of access to the NFS server (i.e., the client's IP must be permitted to mount an export). The EPSS score is approximately 0.023% (0.000230), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE, Feedly).

1. Reconnaissance: Identify NFS servers running a vulnerable version of nfs-utils on the target network using tools like showmount -e <target> or network scanners (e.g., Nmap with NFS scripts) to enumerate exported directories.
2. Identify export restrictions: Review the exported paths and their configured options (e.g., root_squash, all_squash, restricted client IPs) to understand what access is nominally permitted.
3. Mount a permitted export: As a low-privileged NFSv3 client whose IP is allowed to mount at least one export, use mount -t nfs -o vers=3 <server>:<exported_path> /mnt/nfs to establish an initial mount.
4. Exploit path traversal in mountd: Craft an NFSv3 mount request targeting a subdirectory or subtree of the exported path that the client is not explicitly authorized to access (e.g., mount -t nfs -o vers=3 <server>:<exported_path>/<restricted_subdir> /mnt/nfs2). Due to the flaw in rpc.mountd, the daemon incorrectly grants access.
5. Access unauthorized data: Browse and read files within the unauthorized subdirectory, bypassing root_squash/all_squash restrictions and file permission checks, potentially exfiltrating sensitive data (Red Hat Bugzilla, Red Hat CVE).

• Network: Unexpected NFSv3 mount requests (RPC MOUNT protocol, port 20048/tcp or UDP) from known NFS clients targeting subdirectories not explicitly listed in /etc/exports; unusual volume of NFS read operations from a single client IP.
• Logs: Entries in /var/log/messages or syslog showing rpc.mountd granting mount access to paths not matching configured exports; NFS audit logs showing access to directories outside the expected export tree.
• File System: Evidence of file reads in directories that should be inaccessible to the connecting client, detectable via filesystem audit tools (e.g., auditd rules on sensitive subdirectories under NFS exports).
• Process: Unusual rpc.mountd activity or repeated mount/unmount cycles from a single client, visible via showmount -a on the server.

Red Hat released patched packages on March 5, 2026, addressing this vulnerability across all affected RHEL versions:

• RHEL 8: nfs-utils-2.3.3-68.el8_10 via RHSA-2026:3938
• RHEL 9: nfs-utils-2.5.4-38.el9_7.3 via RHSA-2026:3940
• RHEL 10: nfs-utils-2.8.3-0.el10_1.3 via RHSA-2026:3939
• Additional EUS and OpenShift patches were released via RHSA-2026:3941, RHSA-2026:3942, RHSA-2026:5127, RHSA-2026:5867, RHSA-2026:5873, and RHSA-2026:5877.

As a workaround where patching is not immediately possible, administrators should restrict NFS exports to only explicitly needed paths, avoid exporting parent directories when only subdirectories are needed, and use firewall rules to limit NFS access to trusted client IPs only. Upgrading to the patched nfs-utils package is the recommended remediation (Red Hat Bugzilla, RHSA-2026:3938).

Red Hat issued multiple security advisories (RHSA-2026:3938 through RHSA-2026:3942 and subsequent OpenShift advisories) rating the issue as "Moderate" severity. The upstream fix was submitted to the linux-nfs mailing list by Red Hat's Steve Dickson on March 5, 2026. IBM also issued a security bulletin addressing the vulnerability in IBM Db2 on Cloud Pak for Data. The German Linux security news site pro-linux.de covered the issue across multiple advisories for different distributions. AlmaLinux, Rocky Linux, Oracle Linux, and openSUSE all issued their own advisories and patched packages in the weeks following the Red Hat disclosure (Red Hat Bugzilla, IBM Advisory).