A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3938 advisory.

    - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127095)       Resolves: CVE-2025-12801

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3939 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3942 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3939 advisory.

    [2.8.3-0.0.1.el10_1.3]
    - remove multiple warnings when upgrading nfs-utils with gssproxy

    [2.8.3-3]
    - Add requires for selinux-policy (RHEL-127092)

    [2.8.3-2]
    - mountd: Minor refactor of get_rootfh() (RHEL-127092)
    - mountd: Separate lookup of the exported directory and the mount path (RHEL-127092)
    - support: Add a mini-library to extract and apply RPC credentials (RHEL-127092)
    - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127092)       Resolves: CVE-2025-12801

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-3940 advisory.

    [2.5.4-38.0.1.el9_7.3]
    - spec: remove multiple warnings when upgrading nfs-utils with gssproxy [Orabug: 36044562]

    [2.5.4-38.3]
    - Add requires for selinux-policy (RHEL-127104)

    [2.5.4-38.2]
    - Replace statfs64 with statfs (RHEL-127104)
    - NFS export symlink vulnerability fix (RHEL-127104)
    - mountd: Minor refactor of get_rootfh() (RHEL-127104)
    - mountd: Separate lookup of the exported directory and the mount path (RHEL-127104)
    - support: Add a mini-library to extract and apply RPC credentials (RHEL-127104)
    - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127104)       Resolves: CVE-2025-12801

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3941 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3940 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3938 advisory.

    The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools,     which provides better performance than the traditional Linux NFS server used by most users. These packages     also contain the mount.nfs, umount.nfs, and showmount programs.

    Security Fix(es):

    * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that     allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In     particular, it allows the client to access any subdirectory or subtree of an exported directory,     regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes     that would normally be expected to apply to that client. (CVE-2025-12801)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
301406	Oracle Linux 8 : nfs-utils (ELSA-2026-3938)	Nessus	Oracle Linux Local Security Checks	medium
301385	RHEL 10 : nfs-utils (RHSA-2026:3939)	Nessus	Red Hat Local Security Checks	medium
301384	RHEL 9 : nfs-utils (RHSA-2026:3942)	Nessus	Red Hat Local Security Checks	medium
301333	Oracle Linux 10 : nfs-utils (ELSA-2026-3939)	Nessus	Oracle Linux Local Security Checks	medium
301331	Oracle Linux 9 : nfs-utils (ELSA-2026-3940)	Nessus	Oracle Linux Local Security Checks	medium
301325	RHEL 9 : nfs-utils (RHSA-2026:3941)	Nessus	Red Hat Local Security Checks	medium
301250	RHEL 9 : nfs-utils (RHSA-2026:3940)	Nessus	Red Hat Local Security Checks	medium
301176	RHEL 8 : nfs-utils (RHSA-2026:3938)	Nessus	Red Hat Local Security Checks	medium
301116	Linux Distros Unpatched Vulnerability : CVE-2025-12801	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-12801

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium