Security readout for executives and security teams
Plain-English summary
A Linux NFS automount can carry capability settings into a newly crossed filesystem instead of safely resetting and rediscovering them. This may cause the kernel to make incorrect assumptions about the new filesystem, potentially affecting confidentiality, integrity, or availability. Systems not using NFS automounting are less likely to be exposed.
Executive priority
Treat this as an expedited patching priority for NFS automount environments, especially externally connected or business-critical systems. First confirm actual NFS automount use and vendor package status. Systems without this functionality can receive lower priority after documented verification.
Technical view
During NFS automounting, the kernel may inherit capability state across a new filesystem boundary. The fix resets that state to minimal defaults and probes again. The supplied CVSS 3.1 vector indicates network access, low complexity, no privileges or user interaction, and low confidentiality, integrity, and availability impacts. Concrete failure modes are not documented.
Likely exposure
Exposure is concentrated on Linux systems using NFS automounting, particularly workflows crossing into newly mounted filesystems. The bundle lists affected branch versions from 2.6.19 through 6.17 and provides multiple stable-branch fixes. Distribution backports make assessment by version string alone unreliable; confirm status with the relevant vendor.
Exploitation context
The source bundle provides no evidence of active exploitation, public weaponization, or observed attacks, and marks the CVE as absent from KEV. The CVSS vector suggests a network-reachable, unauthenticated condition, but the sources do not document practical prerequisites or a demonstrated attack path.
Researcher notes
In context, “capabilities” likely refers to NFS filesystem or server feature state, not Linux process privileges; the supplied description does not explicitly define it. Evidence establishes improper state inheritance and the reset-and-reprobe correction, but does not describe a reproducer, concrete corruption scenario, affected NFS versions, or confirmed exploitability.
Mitigation direction
- Apply the vendor kernel update incorporating the fix for the system's applicable stable branch.
- Prioritize systems using NFS automounts or crossing into separately mounted NFS filesystems.
- If updates are unavailable, consult vendor guidance; the supplied sources identify no validated workaround.
- Activate the updated kernel according to the vendor's maintenance procedure.
Validation and detection
- Inventory Linux hosts using NFS automounting and record their running kernels and distribution packages.
- Map each kernel package to vendor advisories and the applicable upstream stable fix commit.
- Confirm the active kernel contains the correction after maintenance.
- Retest NFS automount workflows that cross filesystem boundaries for normal operation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39798 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L3.93.4LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/95eb0d97ab98a10e966125c1f274e7d0fc0992b3CVE reference, Linux
- https://git.kernel.org/stable/c/73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9eCVE reference, Linux
- https://git.kernel.org/stable/c/3924dab90816d0c683a110628ef386f83a9d1e13CVE reference, Linux
- https://git.kernel.org/stable/c/175afda783e38c0660f2afc0602dd9c83d4e7ee1CVE reference, Linux
- https://git.kernel.org/stable/c/987c20428f067c1c7f29ed0a2bd8c63fa74b1c2cCVE reference, Linux
- https://git.kernel.org/stable/c/816a6f60c2c2b679a33fa4276442bafd11473651CVE reference, Linux
- https://git.kernel.org/stable/c/a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2CVE reference, Linux
- https://git.kernel.org/stable/c/50e0fd0050e510e749e1fdd1d7158e419ff8f3b9CVE reference, Linux
- https://git.kernel.org/stable/c/b01f21cacde9f2878492cf318fee61bf4ccad323CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.