A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0202 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-12801:
    A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that     allows a NFSv3 client to escalate the     privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to     access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and     regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to     that client.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nfs- utils-2.5.4-42.el9 build changelog.

  - A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that     allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In     particular, it allows the client to access any subdirectory or subtree of an exported directory,     regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes     that would normally be expected to apply to that client. (CVE-2025-12801)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:3940 advisory.

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-289:02 advisory.

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-284:01 advisory.

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:3939 advisory.

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:3938 advisory.

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:3939 advisory.

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:3940 advisory.

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:3938 advisory.

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3938 advisory.

    - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127095)       Resolves: CVE-2025-12801

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3939 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3942 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3939 advisory.

    [2.8.3-0.0.1.el10_1.3]
    - remove multiple warnings when upgrading nfs-utils with gssproxy

    [2.8.3-3]
    - Add requires for selinux-policy (RHEL-127092)

    [2.8.3-2]
    - mountd: Minor refactor of get_rootfh() (RHEL-127092)
    - mountd: Separate lookup of the exported directory and the mount path (RHEL-127092)
    - support: Add a mini-library to extract and apply RPC credentials (RHEL-127092)
    - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127092)       Resolves: CVE-2025-12801

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3940 advisory.

    [2.5.4-38.0.1.el9_7.3]
    - spec: remove multiple warnings when upgrading nfs-utils with gssproxy [Orabug: 36044562]

    [2.5.4-38.3]
    - Add requires for selinux-policy (RHEL-127104)

    [2.5.4-38.2]
    - Replace statfs64 with statfs (RHEL-127104)
    - NFS export symlink vulnerability fix (RHEL-127104)
    - mountd: Minor refactor of get_rootfh() (RHEL-127104)
    - mountd: Separate lookup of the exported directory and the mount path (RHEL-127104)
    - support: Add a mini-library to extract and apply RPC credentials (RHEL-127104)
    - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127104)       Resolves: CVE-2025-12801

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3941 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3940 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3938 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that     allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In     particular, it allows the client to access any subdirectory or subtree of an exported directory,     regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes     that would normally be expected to apply to that client. (CVE-2025-12801)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304568	TencentOS Server 3: nfs-utils (TSSA-2026:0202)	Nessus	Tencent Local Security Checks	medium
302517	CentOS 9 : nfs-utils-2.5.4-42.el9	Nessus	CentOS Local Security Checks	medium
302219	AlmaLinux 9 : nfs-utils (ALSA-2026:3940)	Nessus	Alma Linux Local Security Checks	medium
301927	MiracleLinux 9 : nfs-utils-2.5.4-38.el9_7.3 (AXSA:2026-289:02)	Nessus	Miracle Linux Local Security Checks	medium
301907	MiracleLinux 8 : nfs-utils-2.3.3-68.el8_10 (AXSA:2026-284:01)	Nessus	Miracle Linux Local Security Checks	medium
301868	AlmaLinux 10 : nfs-utils (ALSA-2026:3939)	Nessus	Alma Linux Local Security Checks	medium
301830	AlmaLinux 8 : nfs-utils (ALSA-2026:3938)	Nessus	Alma Linux Local Security Checks	medium
301705	RockyLinux 10 : nfs-utils (RLSA-2026:3939)	Nessus	Rocky Linux Local Security Checks	medium
301704	RockyLinux 9 : nfs-utils (RLSA-2026:3940)	Nessus	Rocky Linux Local Security Checks	medium
301702	RockyLinux 8 : nfs-utils (RLSA-2026:3938)	Nessus	Rocky Linux Local Security Checks	medium
301406	Oracle Linux 8 : nfs-utils (ELSA-2026-3938)	Nessus	Oracle Linux Local Security Checks	medium
301385	RHEL 10 : nfs-utils (RHSA-2026:3939)	Nessus	Red Hat Local Security Checks	medium
301384	RHEL 9 : nfs-utils (RHSA-2026:3942)	Nessus	Red Hat Local Security Checks	medium
301333	Oracle Linux 10 : nfs-utils (ELSA-2026-3939)	Nessus	Oracle Linux Local Security Checks	medium
301331	Oracle Linux 9 : nfs-utils (ELSA-2026-3940)	Nessus	Oracle Linux Local Security Checks	medium
301325	RHEL 9 : nfs-utils (RHSA-2026:3941)	Nessus	Red Hat Local Security Checks	medium
301250	RHEL 9 : nfs-utils (RHSA-2026:3940)	Nessus	Red Hat Local Security Checks	medium
301176	RHEL 8 : nfs-utils (RHSA-2026:3938)	Nessus	Red Hat Local Security Checks	medium
301116	Linux Distros Unpatched Vulnerability : CVE-2025-12801	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-12801

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium