Description
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
Published: 2026-10-16
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A flaw exists in nfs-utils' rpc.statd service. An unauthenticated remote attacker can send repeated state notification requests that cause the service to leak memory. Over time the memory consumption grows until system resources are exhausted, which can result in the service degrading or crashing, causing a denial of service to the NFS service.

Affected Systems

The vulnerability affects Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat OpenShift Container Platform 4.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. No exploit probability is publicly available and the vulnerability is not listed in CISA’s KEV catalog. Attack requires no authentication and only an exposed rpc.statd service. An attacker could repeatedly issue RPC state notifications to cause memory exhaustion, leading to DoS.

Generated by OpenCVE AI on October 17, 2026 at 00:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor provided patch for nfs-utils that resolves the rpc.statd memory leak.
  • If a patch is not yet available, limit exposure of rpc.statd to trusted networks or block external access using firewall rules or SELinux policies.
  • Monitor memory usage and restart the rpc.statd service or the NFS server when abnormal memory growth is detected.

Generated by OpenCVE AI on October 17, 2026 at 00:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 16 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
Title Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-772
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-16T23:06:19.924Z

Reserved: 2026-09-10T20:51:57.497Z

Link: CVE-2026-89096

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-16T23:17:02.810

Modified: 2026-10-16T23:17:02.810

Link: CVE-2026-89096

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-16T22:47:37Z

Links: CVE-2026-89096 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T00:30:13Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime