CVE-2026-89096 Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
An unauthenticated remote attacker can cause a denial of service in rpc.statd by triggering a memory leak through repeated state notification requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89096?
CVE-2026-89096 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
Weakness: CWE-772
Which versions are affected by CVE-2026-89096?
How do I fix CVE-2026-89096?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89096 being exploited?
There is no known exploitation of CVE-2026-89096 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89096, DEBIAN-CVE-2026-89096, ECHO-512c-f79e-b6d0, GHSA-vm5m-6m89-c34w, UBUNTU-CVE-2026-89096.