CVE-2025-39798 (GCVE-0-2025-39798)
Vulnerability from cvelistv5
Published
2025-09-12 15:59
Modified
2026-08-05 12:05
Severity ?
7.3 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Summary
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.
References
Impacted products
Vendor Product Version
Linux Linux Version: 54ceac4515986030c2502960be620198dd8fe25b
Version: 54ceac4515986030c2502960be620198dd8fe25b
Version: 54ceac4515986030c2502960be620198dd8fe25b
Version: 54ceac4515986030c2502960be620198dd8fe25b
Version: 54ceac4515986030c2502960be620198dd8fe25b
Version: 54ceac4515986030c2502960be620198dd8fe25b
Version: 54ceac4515986030c2502960be620198dd8fe25b
Version: 54ceac4515986030c2502960be620198dd8fe25b
Version: 54ceac4515986030c2502960be620198dd8fe25b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:43:29.893Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:57.171Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/client.c",
            "fs/nfs/internal.h",
            "fs/nfs/nfs4client.c",
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95eb0d97ab98a10e966125c1f274e7d0fc0992b3",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            },
            {
              "lessThan": "73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9e",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            },
            {
              "lessThan": "3924dab90816d0c683a110628ef386f83a9d1e13",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            },
            {
              "lessThan": "175afda783e38c0660f2afc0602dd9c83d4e7ee1",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            },
            {
              "lessThan": "987c20428f067c1c7f29ed0a2bd8c63fa74b1c2c",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            },
            {
              "lessThan": "816a6f60c2c2b679a33fa4276442bafd11473651",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            },
            {
              "lessThan": "a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            },
            {
              "lessThan": "50e0fd0050e510e749e1fdd1d7158e419ff8f3b9",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            },
            {
              "lessThan": "b01f21cacde9f2878492cf318fee61bf4ccad323",
              "status": "affected",
              "version": "54ceac4515986030c2502960be620198dd8fe25b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/client.c",
            "fs/nfs/internal.h",
            "fs/nfs/nfs4client.c",
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable state is produced while the NFS client processes a remote server\u0027s export topology and SERVER_CAPS/FSINFO replies when crossing a server-side mountpoint or following an NFSv4 referral. A malicious/compromised NFS server, or an attacker MITM\u0027ing the common unauthenticated AUTH_SYS NFS connection, controls every input needed to trigger the mismatch.\nAC:L - The attacker-controlled server simply exports a nested filesystem (distinct FSID) or referral whose capability set differs from the parent\u0027s; the stale-capability inheritance then occurs deterministically on every crossing. No race, timing, or memory-layout condition is involved.\nPR:N - No credentials or privileges on the client are needed \u2014 the malicious data comes from the remote server side, and the automount is performed by the client kernel during ordinary path traversal. Local reachability likewise requires only an unprivileged user walking into the mountpoint.\nUI:N - Automount is by definition transparent: any process, including background daemons, indexers or backup jobs, that traverses into the server-side mountpoint triggers nfs_d_automount() and the faulty clone. No distinct victim action beyond normal use of an already-mounted share is required.\nS:U - The incorrect capability state stays within the NFS client\u0027s own security authority in the client kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - Stale NFS_CAP_UIDGID_NOMAP causes the client to encode/interpret owner and group identities as raw numeric IDs on a filesystem that expects idmapped names, so files can be attributed to the wrong principal and exposed to the wrong local user; this is limited, bounded metadata exposure rather than arbitrary kernel memory disclosure.\nI:L - The same stale identity-mapping state means creates/chowns on the automounted filesystem can land under an incorrect owner, and inherited NFS_CAP_DELEGTIME makes the client locally manage timestamps against a server that never granted delegated timestamps. This is limited metadata/ownership corruption, not an arbitrary write or control-flow hijack.\nA:L - Inherited NFS_CAP_FS_LOCATIONS with trunking discovery makes nfs_probe_fsinfo() fail and aborts the automount, and inherited NFS_CAP_OPEN_XOR/XATTR cause OPEN and xattr operations to be rejected with NFS4ERR_NOTSUPP, rendering the crossed subtree unusable. There is no kernel crash, hang, or panic, so the loss of availability is confined to the affected mount."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:15.150Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95eb0d97ab98a10e966125c1f274e7d0fc0992b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3924dab90816d0c683a110628ef386f83a9d1e13"
        },
        {
          "url": "https://git.kernel.org/stable/c/175afda783e38c0660f2afc0602dd9c83d4e7ee1"
        },
        {
          "url": "https://git.kernel.org/stable/c/987c20428f067c1c7f29ed0a2bd8c63fa74b1c2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/816a6f60c2c2b679a33fa4276442bafd11473651"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/50e0fd0050e510e749e1fdd1d7158e419ff8f3b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b01f21cacde9f2878492cf318fee61bf4ccad323"
        }
      ],
      "title": "NFS: Fix the setting of capabilities when automounting a new filesystem",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39798",
    "datePublished": "2025-09-12T15:59:34.386Z",
    "dateReserved": "2025-04-16T07:20:57.133Z",
    "dateUpdated": "2026-08-05T12:05:15.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.