CVE-2025-12801

MEDIUM

6.5

CVSS v3

Description

A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

CWE-279 CWE-732Incorrect Permission Assignment for Critical Resource

How to fix

Remediation Available

nfs-utilsDebian

Fixed in:1:2.8.6-1CVE-2025-12801

libnfsidmapRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

libnfsidmapRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

libnfsidmap-debuginfoRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

libnfsidmap-debuginfoRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

libnfsidmap-develRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

libnfsidmap-develRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

nfs-utilsRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

nfs-utilsRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

nfs-utils-coreosRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.5.4-34.el9_6.3RHSA-2026:3941

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

Fixed in:1:2.5.4-34.el9_6.3RHSA-2026:3941

nfs-utils-coreosRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.5.4-34.el9_6.3RHSA-2026:3941

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

nfs-utils-coreos-debuginfoRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

Fixed in:1:2.5.4-26.el9_4.3RHSA-2026:3942

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

Fixed in:1:2.5.4-26.el9_4.3RHSA-2026:3942

nfs-utils-coreos-debuginfoRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

Fixed in:1:2.5.4-26.el9_4.3RHSA-2026:3942

Fixed in:1:2.5.4-34.el9_6.3RHSA-2026:3941

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

nfs-utils-debuginfoRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

nfs-utils-debuginfoRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

nfs-utils-debugsourceRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

nfs-utils-debugsourceRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.3.3-68.el8_10RHSA-2026:3938

nfsv4-client-utilsRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.5.4-34.el9_6.3RHSA-2026:3941

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

nfsv4-client-utilsRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.5.4-34.el9_6.3RHSA-2026:3941

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

Fixed in:1:2.5.4-34.el9_6.3RHSA-2026:3941

nfsv4-client-utils-debuginfoRocky

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.5.4-34.el9_6.3RHSA-2026:3941

Fixed in:1:2.5.4-38.el9_7.3RHSA-2026:3940

Fixed in:1:2.5.4-26.el9_4.3RHSA-2026:3942

nfsv4-client-utils-debuginfoRed Hat / RHEL

Fixed in:1:2.8.3-0.el10_1.3RHSA-2026:3939

Fixed in:1:2.5.4-26.el9_4.3RHSA-2026:3942

registry.redhat.io/rhceph/rhcephRocky

Fixed in:8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64RHSA-2026:5606

Fixed in:8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64leRHSA-2026:5606

Fixed in:8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390xRHSA-2026:5606

Fixed in:8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64RHSA-2026:5606

registry.redhat.io/rhceph/rhcephRed Hat / RHEL

Fixed in:8-rhel9@sha256:2a73d2ab438040547d61bf4257a50a3d33cb5e74f40d372a865fe0db9ba9d5af_arm64RHSA-2026:5606

Fixed in:8-rhel9@sha256:a0f0f9770911d6a0fc522f304942765059643193e95c9f6e505462f98a979db1_s390xRHSA-2026:5606

Fixed in:8-rhel9@sha256:ba2480ebb7946082380496ad7b92b92560a8bb9ddcd8e2f94f0c502ce65c1d0c_ppc64leRHSA-2026:5606

Fixed in:8-rhel9@sha256:1160569002c25d3d349bbe41b57eeffade438853d3419edca01813227440f414_amd64RHSA-2026:5606

rhcos-aarch64Rocky

Fixed in:416.94.202603231244-0RHSA-2026:5873

Fixed in:4.19.9.6.202603251941-0RHSA-2026:5877

Fixed in:418.94.202603181125-0RHSA-2026:5127

Fixed in:417.94.202603242359-0RHSA-2026:5867

rhcos-aarch64Red Hat / RHEL

Fixed in:417.94.202603242359-0RHSA-2026:5867

Fixed in:4.19.9.6.202603251941-0RHSA-2026:5877

Fixed in:416.94.202603231244-0RHSA-2026:5873

Fixed in:418.94.202603181125-0RHSA-2026:5127

rhcos-ppc64leRed Hat / RHEL

Fixed in:416.94.202603231244-0RHSA-2026:5873

Fixed in:418.94.202603181125-0RHSA-2026:5127

Fixed in:4.19.9.6.202603251941-0RHSA-2026:5877

Fixed in:417.94.202603242359-0RHSA-2026:5867

rhcos-ppc64leRocky

Fixed in:418.94.202603181125-0RHSA-2026:5127

Fixed in:416.94.202603231244-0RHSA-2026:5873

Fixed in:417.94.202603242359-0RHSA-2026:5867

Fixed in:4.19.9.6.202603251941-0RHSA-2026:5877

rhcos-s390xRed Hat / RHEL

Fixed in:4.19.9.6.202603251941-0RHSA-2026:5877

Fixed in:417.94.202603242359-0RHSA-2026:5867

Fixed in:416.94.202603231244-0RHSA-2026:5873

Fixed in:418.94.202603181125-0RHSA-2026:5127

rhcos-s390xRocky

Fixed in:418.94.202603181125-0RHSA-2026:5127

Fixed in:416.94.202603231244-0RHSA-2026:5873

Fixed in:4.19.9.6.202603251941-0RHSA-2026:5877

Fixed in:417.94.202603242359-0RHSA-2026:5867

rhcos-x86_64Rocky

Fixed in:418.94.202603181125-0RHSA-2026:5127

Fixed in:4.19.9.6.202603251941-0RHSA-2026:5877

Fixed in:417.94.202603242359-0RHSA-2026:5867

Fixed in:416.94.202603231244-0RHSA-2026:5873

This vulnerability affects an unusually large number of packages. The highest-confidence fixes are shown above; the full list is longer. Check the referenced advisories for complete coverage.

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploit Intelligence

0.46%probability of exploitation in 30 days

38thpercentile

Low risk: more likely to be exploited than 38% of all known CVEs.

References

Third-Party Advisory7

Other references5

Related Vulnerabilities

Other CWE-279 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2023-4665	High	8.8	1.1%	-	Fix
CVE-2017-8441	Medium	4.3	0.9%	-	Fix
CVE-2024-37734	Critical	9.8	0.8%	-	-
CVE-2023-50914	Medium	6.7	0.7%	-	-
CVE-2022-21699	High	8.2	0.7%	-	Fix
CVE-2023-3915	Medium	6.5	0.6%	-	Fix

Common questions

How do I fix CVE-2025-12801?

Published advisories record a fix for 31 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.

Is CVE-2025-12801 being actively exploited?

Not that we know of. CVE-2025-12801 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.46% is the estimated probability that it will be exploited in the next 30 days. That is higher than 38% of all scored CVEs.

How severe is CVE-2025-12801?

CVE-2025-12801 has a CVSS v3 base score of 6.5, rated medium. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2025-12801 affect?

Published advisories record a fix for nfs-utils (Debian), libnfsidmap (Red Hat / RHEL), libnfsidmap (Rocky), libnfsidmap-debuginfo (Red Hat / RHEL), and 27 more. Only products with a sourced advisory are listed, so treat this as what we can cite rather than a complete inventory.

Embed a live status badge for CVE-2025-12801

Markdown

[![CVE-2025-12801](https://tridentstack.com/cve/badge/CVE-2025-12801.svg)](https://tridentstack.com/cve/CVE-2025-12801)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-12801"><img src="https://tridentstack.com/cve/badge/CVE-2025-12801.svg" alt="CVE-2025-12801"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it works Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-06-30.