rpc.mountd: NFSv3 client bypasses export restrictions and root_squash on subdirectories

Impact

An NFSv3 client that is permitted to mount one exported path can reach any subdirectory or subtree of that export, ignoring the file permissions and the root_squash/all_squash attributes that the /etc/exports line was supposed to enforce. On a GPU fleet this matters because NFS is the default way home directories, dataset shares and checkpoint stores are handed to training nodes, and the squash attributes are usually the only thing standing between a tenant node and other tenants' data on the same export. Red Hat rates it 6.5 with confidentiality-only impact - it is a read/access-control bypass, not a write or code-execution flaw. Any node or pod already granted an NFS mount is the attacker here, so the blast radius is the whole export tree, not just the path handed out.

Who can reach it

Any host allowed to mount an NFSv3 export - a compute node, a tenant VM, or a pod with hostPath/NFS volume access. No additional authentication beyond what the export already grants (CVSS says PR:L, network reachable).

What to do

Update nfs-utils on every NFS server from the Red Hat errata (RHSA-2026:3938 through 3942 cover RHEL 8, 9, 9.4/9.6 EUS, 10 and OpenShift 4.16/4.17) and restart rpc.mountd; clients do not need to be rebooted, though in-flight mounts should be re-checked. OpenShift clusters running an in-cluster NFS server need the corresponding container image rolled. Until patched, the only real mitigation is narrowing the export list and the client ACLs in /etc/exports, since root_squash cannot be relied on.

References

Related entries

• OpenVINO Model Server: An unauthenticated request can drive OpenVINO Model Server into unbounded resource consumptionCVE-2025-22892 · OpenVINO Model ServerMedium
• IBM Storage Scale SMB protocol stack (inherited ACL handling): Files created or modified over SMB inherit permissionsCVE-2025-36104 · IBM Storage Scale SMB protocol stack (inherited ACL handling)Medium
• CephFS (ceph-fuse client): A tenant with an ordinary unprivileged UID on a node that has a CephFS volume mounted viaCVE-2025-52555 · CephFS (ceph-fuse client)Medium
• PostgreSQL pgcrypto: PGP functions emit recoverable cleartext when OpenSSL disables the cipherCVE-2026-14663 · PostgreSQL pgcrypto (pgp_sym_encrypt / pgp_pub_encrypt family)Medium
• open-iscsi iscsiuio (DHCPv6 handling): Integer underflow and out-of-bounds read in iscsiuio's DHCPv6 handlingCVE-2026-18727 · open-iscsi iscsiuio (DHCPv6 handling)Medium
• lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload fourCVE-2026-46433 · lldpd (802.1Q VLAN tag stripping in lldpd_decode)Medium