Linux NFS client: automounted submounts drop ro, noexec, nodev and sync mount options

Impact

When the kernel NFS client automatically mounts a nested filesystem below an NFS mount (for example an export that crosses into another filesystem on the server), the new mount did not inherit the options the operator set on the parent mount: ro, noexec, nodev and sync. An export mounted read-only or noexec to protect shared datasets, home directories or scratch space could therefore become writable, or allow binaries to run, below the automount point. This matters on HPC and GPU clusters where many nodes and users share NFS and rely on these options as a boundary. The record is brief and does not say how widely the gap can be exploited in practice.

Who can reach it

A local user on an NFS client node who can reach an automounted submount below a restricted NFS mount. They need an account on the node. Only setups where the server exposes nested filesystems that the client automounts are affected.

What to do

Install a kernel carrying the stable fix on NFS client nodes, then drain and reboot each node. The record does not name fixed kernel versions, so check your distribution's kernel advisory. Until a node is patched, do not rely on ro, noexec or nodev holding below automount points. Mount the nested exports explicitly with the options you need, or enforce read-only access on the server side.

References

Related entries

• N-able N-central: Deserialization of untrusted data allowing local code execution on the RMM serverCVE-2025-8875 · N-able N-centralHigh
• Azure NFS mount helper (aznfs): untrusted search path allows local privilege escalationCVE-2026-105494 · Azure NFS mount helper (aznfs)High
• ansible-core: malicious Galaxy role injects git flags to run code on the machine installing itCVE-2026-11332 · ansible-core (ansible-galaxy role install, git argument injection via meta/requirements.yml)High
• ansible-core: git argument injection in ansible-galaxy collection install yields command executionCVE-2026-16493 · ansible-core (ansible-galaxy collection install, git source URL handling)High
• Linux kernel nfsd: use-after-free when writing v4_end_grace races with server shutdownCVE-2026-22980 · Linux kernel nfsd (v4_end_grace write vs server shutdown)High
• Linux kernel iSCSI target: use-after-free on session teardown when complete() is called under the lockCVE-2026-23193 · Linux kernel iSCSI target (iscsit_dec_session_usage_count)High