CVE-2026-89096

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

This vulnerability is rated as Moderate impact rather than Important because exploitation requires multiple conditions: direct network reachability to the rpc.statd daemon, an existing monitored host entry, and continuous state-cycling notification requests. In standard Red Hat Enterprise Linux deployments, NFSv4 is used by default, eliminating reliance on rpc.statd for file lock monitoring. Furthermore, default firewall policies block incoming remote procedure call traffic from untrusted networks, restricting exposure primarily to legacy NFSv3 configurations that accept remote traffic from unverified sources.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.