Description
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the
privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat Ceph Storage 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nfs-utils | 1:2.8.6-1 | — |
| Debian 13 | nfs-utils | No fix yet | — |
| Debian 12 | nfs-utils | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu 26.10 | linux +8 | No fix yet | — |
| Ubuntu 26.04 LTS | linux +14 | No fix yet | — |
| Ubuntu 25.10 | linux +8 | No fix yet | — |
Show 20 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux +52 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +59 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime +3 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime +2 | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +21 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nfs-utils +4 | 1:2.8.3-0.el10_1.3 | RHSA-2026:3939 |
| RHEL 9 | nfs-utils +4 | 1:2.5.4-38.el9_7.3 | RHSA-2026:3940 |
| RHEL 8 | nfs-utils +2 | 1:2.3.3-68.el8_10 | RHSA-2026:3938 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | nfs-utils +4 | 1:2.5.4-34.el9_6.3 | RHSA-2026:3941 |
| RHEL 9.4 EUS | nfs-utils +4 | 1:2.5.4-26.el9_4.3 | RHSA-2026:3942 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nfs-utils +4 | 1:2.8.3-0.el10_1.3 | ALSA-2026:3939 |
| AlmaLinux 9 | nfs-utils +4 | 1:2.5.4-38.el9_7.3 | ALSA-2026:3940 |
| AlmaLinux 8 | nfs-utils +2 | 1:2.3.3-68.el8_10 | ALSA-2026:3938 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nfs-utils | 1:2.8.3-0.el10_1.3 | RLSA-2026:3939 |
| Rocky Linux 9 | nfs-utils | 1:2.5.4-38.el9_7.3 | RLSA-2026:3940 |
| Rocky Linux 8 | nfs-utils | 1:2.3.3-68.el8_10 | RLSA-2026:3938 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libnfsidmap0 | 0.26-150600.28.19.1 | SUSE-SU-2026:1356-1 |
| SLES 15 SP7 | nfs-utils | 2.6.4-150600.28.19.1 | SUSE-SU-2026:1356-1 |
| SLES 15 SP6 | libnfsidmap0 | 0.26-150600.28.19.1 | SUSE-SU-2026:1356-1 |
| SLES 15 SP6 | nfs-utils | 2.6.4-150600.28.19.1 | SUSE-SU-2026:1356-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | libnfsidmap0 | 0.26-150600.28.19.1 | SUSE-SU-2026:1356-1 |
| SLES for SAP 15 SP6 | nfs-utils | 2.6.4-150600.28.19.1 | SUSE-SU-2026:1356-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | libnfsidmap0 | 0.26-150600.28.19.1 | SUSE-SU-2026:1356-1 |
| openSUSE Leap 15.6 | nfs-utils | 2.6.4-150600.28.19.1 | SUSE-SU-2026:1356-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nfs-utils +4 | 1:2.8.3-0.0.1.el10_1.3 | ELSA-2026-3939 |
| Oracle Linux 9 | nfs-utils +4 | 1:2.5.4-38.0.1.el9_7.3 | ELSA-2026-3940 |
| Oracle Linux 8 | nfs-utils +2 | 1:2.3.3-68.0.1.el8_10 | ELSA-2026-3938 |
Advisories 16
- ALSA-2026:3939 Moderate: nfs-utils security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:3940 Moderate: nfs-utils security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:3938 Moderate: nfs-utils security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:3942 Red Hat Security Advisory: nfs-utils security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:3941 Red Hat Security Advisory: nfs-utils security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:3940 Red Hat Security Advisory: nfs-utils security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:3938 Red Hat Security Advisory: nfs-utils security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:3939 Red Hat Security Advisory: nfs-utils security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- WID-SEC-2026-0615 Red Hat Enterprise Linux (nfs-utils): Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · May 18, 2026
- SUSE-SU-2026:1356-1 Security update for nfs-utils SUSE / openSUSE Security Updates · Apr 16, 2026
- RLSA-2026:3938 Moderate: nfs-utils security update Rocky Linux Security Advisories · Mar 23, 2026
- RLSA-2026:3939 Moderate: nfs-utils security update Rocky Linux Security Advisories · Mar 23, 2026
- RLSA-2026:3940 Moderate: nfs-utils security update Rocky Linux Security Advisories · Mar 23, 2026
- ELSA-2026-3938 Moderate: nfs-utils security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Mar 6, 2026
- ELSA-2026-3939 Moderate: nfs-utils security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Mar 5, 2026
- ELSA-2026-3940 Moderate: nfs-utils security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 5, 2026
References
- RHSA-2026:3938 vendor-advisory
- RHSA-2026:3939 vendor-advisory
- RHSA-2026:3940 vendor-advisory
- RHSA-2026:3941 vendor-advisory
- RHSA-2026:3942 vendor-advisory
- RHSA-2026:5127 vendor-advisory
- RHSA-2026:5606 vendor-advisory
- RHSA-2026:5867 vendor-advisory
- RHSA-2026:5873 vendor-advisory
- RHSA-2026:5877 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-12801 vdb-entry
- RHBZ#2413081 issue-tracking