CVE-2026-89096

Received Received - Intake

Denial of Service in nfs-utils rpc.statd Service

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: redhat-SADP

Description

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-89096

EUVD

EUVD-2026-103204

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *
Red	Hat	Red Hat OpenShift Container Platform 4 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

Executive Summary

This is a Denial of Service (DoS) vulnerability in nfs-utils. An attacker can exploit it by sending repeated state notification requests to the rpc.statd service without authentication. The service fails to release memory after processing callbacks, causing continuous memory growth. Eventually, this exhausts system resources and crashes the service.

Detection Guidance

To detect this vulnerability, monitor for unusual memory usage in the rpc.statd service. Check if the service is running with commands like 'systemctl status nfs-server' or 'ps aux | grep rpc.statd'. Use 'netstat -tulnp | grep 100021' to verify if the rpc.statd port (100021) is exposed. High memory consumption or repeated service restarts may indicate exploitation.

Impact Analysis

The vulnerability can lead to service degradation or complete crashes of the rpc.statd service. This disrupts file sharing operations, causes downtime, and may affect dependent applications relying on NFS functionality.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions or crashes due to resource exhaustion. GDPR requires maintaining data processing integrity and availability, while HIPAA mandates reliable access to protected health information. A DoS condition may violate these requirements by disrupting service availability.

Mitigation Strategies

Immediately disable the rpc.statd service if not needed using 'systemctl stop nfs-server' and 'systemctl disable nfs-server'. If required, restrict network access to the service via firewall rules (e.g., 'firewall-cmd --permanent --add-rich-rule="rule family="ipv4" port port="100021" protocol="tcp" reject"'). Apply patches from your vendor once available.

Hi! I’m here to help you understand CVE-2026-89096. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70