CVE-2026-94640 Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service
Unauthenticated remote attackers can cause denial of service in rpcbind by sending unique requests that trigger unbounded memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94640?
CVE-2026-94640 is a high-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 22 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
Weakness: CWE-400
Which versions are affected by CVE-2026-94640?
Linux distribution packages (24)
rpcbind AlmaLinux:10 | All versions | 1.2.7-3.el10_2.1 |
rpcbind AlmaLinux:8 | All versions | 1.2.5-11.el8_10 |
rpcbind AlmaLinux:9 | All versions | 1.2.6-7.el9_8.1 |
rpcbind Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.7-3.el10_2.1 |
rpcbind-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.7-3.el10_2.1 |
rpcbind-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:1.2.7-3.el10_2.1 |
rpcbind Red Hat:enterprise_linux:8::baseos | All versions | 0:1.2.5-11.el8_10 |
rpcbind-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:1.2.5-11.el8_10 |
rpcbind-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:1.2.5-11.el8_10 |
rpcbind Red Hat:enterprise_linux:9::baseos | All versions | 0:1.2.6-7.el9_8.1 |
rpcbind-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:1.2.6-7.el9_8.1 |
rpcbind-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:1.2.6-7.el9_8.1 |
rpcbind Rocky Linux:10 | All versions | 0:1.2.7-3.el10_2.1 |
rpcbind Rocky Linux:8 | All versions | 0:1.2.5-11.el8_10 |
rpcbind Rocky Linux:9 | All versions | 0:1.2.6-7.el9_8.1 |
rpcbind SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 0.2.3-24.18.1 |
rpcbind SUSE:Linux Enterprise Server 16.0 | All versions | 1.2.9-160000.3.1 |
rpcbind SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 0.2.3-24.18.1 |
rpcbind SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.2.9-160000.3.1 |
rpcbind SUSE:Linux Micro 6.0 | All versions | 1.2.9-159998.1.1 |
rpcbind SUSE:Linux Micro 6.1 | All versions | 1.2.9-slfo.1.1_3.1 |
rpcbind SUSE:Linux Micro 6.2 | All versions | 1.2.9-160000.3.1 |
rpcbind openSUSE:Leap 16.0 | All versions | 1.2.9-160000.3.1 |
rpcbind openSUSE:Tumbleweed | All versions | 1.2.9-3.1 |
How do I fix CVE-2026-94640?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-94640 being exploited?
There is no known exploitation of CVE-2026-94640 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:83561, ALSA-2026:83562, ALSA-2026:83563, AZL-105807, DEBIAN-CVE-2026-94640, ECHO-bd66-6a5e-e958 and 15 more.