CVE-2025-12801: Linux NFS Utils Privilege Escalation Flaw

CVE-2025-12801 Overview

A privilege escalation vulnerability was discovered in the rpc.mountd daemon within the nfs-utils package for Linux. This vulnerability allows NFSv3 clients to escalate privileges assigned to them in the /etc/exports file at mount time. Specifically, an attacker can exploit this flaw to access any subdirectory or subtree of an exported directory, regardless of the configured file permissions and bypassing root_squash or all_squash attributes that would normally restrict access.

Critical Impact

NFSv3 clients can bypass file permission controls and root_squash/all_squash security attributes, potentially gaining unauthorized access to sensitive files and directories on NFS-exported filesystems.

Affected Products

• nfs-utils package for Linux (rpc.mountd daemon)
• Linux systems with NFSv3 exports configured
• Systems relying on root_squash or all_squash for access control

Discovery Timeline

• 2026-03-04 - CVE-2025-12801 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2025-12801

Vulnerability Analysis

This vulnerability is classified under CWE-279 (Incorrect Execution-Assigned Permissions), indicating a fundamental flaw in how the rpc.mountd daemon enforces permission assignments during the NFS mount process. The vulnerability affects the NFSv3 protocol implementation and allows authenticated clients to circumvent the security boundaries established through /etc/exports configuration.

When an NFS share is exported with security attributes such as root_squash (which maps the root user to the anonymous user) or all_squash (which maps all users to anonymous), these controls are intended to prevent privilege escalation. However, due to this flaw, a malicious NFSv3 client can bypass these restrictions and traverse into subdirectories beyond their authorized scope, effectively escalating their access privileges.

The vulnerability has a network attack vector, meaning it can be exploited by any authenticated client that can connect to the NFS server over the network. The low attack complexity makes this vulnerability particularly concerning for environments that rely heavily on NFS for file sharing.

Root Cause

The root cause lies in improper permission validation within the rpc.mountd daemon during the mount request handling process. The daemon fails to correctly enforce the permission boundaries defined in /etc/exports when processing NFSv3 client requests, allowing clients to traverse directory structures and access files beyond their authorized mount points. This represents a failure in the execution-assigned permissions model (CWE-279).

Attack Vector

The attack is network-based and requires low-privileged authentication to the NFS server. An attacker with legitimate NFSv3 client access can exploit this vulnerability by crafting mount requests that bypass the configured export restrictions. The exploitation does not require user interaction, making it suitable for automated attacks against vulnerable NFS infrastructure.

The attack scenario involves:

1. An attacker establishes a legitimate NFSv3 connection to the target server
2. The attacker issues mount requests that target subdirectories outside their authorized export path
3. Due to the vulnerability, the rpc.mountd daemon grants access despite root_squash or all_squash configurations
4. The attacker gains unauthorized read access to sensitive files and directories

Detection Methods for CVE-2025-12801

Indicators of Compromise

• Unexpected NFS mount requests targeting subdirectories outside normal export boundaries
• Anomalous file access patterns from NFSv3 clients accessing directories they shouldn't have permission to view
• Log entries showing successful mounts to restricted subtrees despite export restrictions
• Increased NFS traffic from clients performing directory traversal operations

Detection Strategies

• Monitor /var/log/messages or journal logs for unusual rpc.mountd activity and mount requests
• Implement audit rules on NFS-exported directories to track unauthorized access attempts
• Deploy network monitoring to detect anomalous NFSv3 protocol behavior and unexpected mount patterns
• Use SentinelOne Singularity platform to monitor for suspicious file system access on NFS servers

Monitoring Recommendations

• Enable verbose logging for rpc.mountd to capture detailed mount request information
• Configure auditd rules to monitor access to sensitive directories within NFS exports
• Implement network segmentation to limit NFSv3 client connectivity to authorized hosts only
• Review NFS export logs regularly for clients accessing subdirectories outside their designated mount points

How to Mitigate CVE-2025-12801

Immediate Actions Required

• Update nfs-utils to the latest patched version available from your Linux distribution
• Review all /etc/exports configurations and ensure exports are as restrictive as possible
• Consider temporarily disabling NFSv3 in favor of NFSv4 if backward compatibility permits
• Implement network-level access controls to restrict which hosts can connect to NFS services
• Audit current NFS mounts and access patterns to identify potential exploitation

Patch Information

Red Hat has released security errata RHSA-2026:3938 addressing this vulnerability. Organizations should consult their Linux distribution's security advisories for updated nfs-utils packages. Additional details are available from Red Hat's CVE-2025-12801 page and the associated bug report.

Workarounds

• Migrate to NFSv4 which uses a different authentication and authorization model not affected by this vulnerability
• Use firewall rules to restrict NFS port access (TCP/UDP 2049, portmapper ports) to trusted clients only
• Implement more granular export definitions with specific subdirectory exports rather than parent directory exports
• Enable Kerberos authentication for NFS to add an additional security layer

# Example: Restrict NFS access with firewall rules
# Allow NFS only from trusted network segment
iptables -A INPUT -p tcp --dport 2049 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 2049 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2049 -j DROP
iptables -A INPUT -p udp --dport 2049 -j DROP

# Verify current NFS exports configuration
exportfs -v