Description
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
Published: 2026-10-16
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A flaw exists in nfs-utils' rpc.statd service. An unauthenticated remote attacker can send repeated state notification requests that cause the service to leak memory. Over time the memory consumption grows until system resources are exhausted, which can result in the service degrading or crashing, causing a denial of service to the NFS service.

Affected Systems

The vulnerability affects Red Hat Enterprise Linux 10, 6, 7, 8, and 9, as well as Red Hat OpenShift Container Platform 4.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. No exploit probability is publicly available and the vulnerability is not listed in CISA’s KEV catalog. Attack requires no authentication and only an exposed rpc.statd service. An attacker could repeatedly issue RPC state notifications to cause memory exhaustion, leading to DoS.

Generated by OpenCVE AI on October 17, 2026 at 00:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor provided patch for nfs-utils that resolves the rpc.statd memory leak.
  • If a patch is not yet available, limit exposure of rpc.statd to trusted networks or block external access using firewall rules or SELinux policies.
  • Monitor memory usage and restart the rpc.statd service or the NFS server when abnormal memory growth is detected.

Generated by OpenCVE AI on October 17, 2026 at 00:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9		 cpe:/a:redhat:enterprise_linux:10
cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:openshift:5
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Nfs
Nfs nfs-utils
Redhat openshift Container Platform
Vendors & Products Nfs
Nfs nfs-utils
Redhat openshift Container Platform

Mon, 19 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 16 Oct 2026 23:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
Title Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-772
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Nfs Nfs-utils
Redhat Enterprise Linux Openshift Openshift Container Platform Rhel Els
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-06T01:13:51.951Z

Reserved: 2026-09-10T20:51:57.497Z

Link: CVE-2026-89096

cve-icon Vulnrichment

Updated: 2026-10-19T15:35:22.396Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-16T23:17:02.810

Modified: 2026-11-06T02:17:56.017

Link: CVE-2026-89096

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-16T22:47:37Z

Links: CVE-2026-89096 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T17:02:41Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime