CVE-2026-89096 Red Hat CVE debrief

Who should care

Defenders responsible for nfs-utils deployments, particularly those with exposed rpc.statd services, should assess their exposure and verify system resource limitations. They should also prioritize verifying exposure of rpc.statd services and assessing system resource limitations to mitigate potential Denial of Service (DoS) attacks. Operators, platform administrators, vulnerability management teams, and security teams may be impacted by this vulnerability

Why it matters

CVE-2026-89096 is a Denial of Service vulnerability in nfs-utils that can lead to system resource exhaustion and service degradation under sustained attack. Defenders should prioritize verifying exposure of rpc.statd services and assessing system resource limitations.

• Potential system resource exhaustion
• Service degradation or crash under sustained attack
• Need for verification of rpc.statd service exposure
• Requirement for assessing system resource limitations

Technical summary

The vulnerability is caused by improper memory release during callback processing in rpc.statd service, leading to continuous memory growth and potential system resource exhaustion. This flaw can be triggered by an unauthenticated remote attacker sending repeated state notification requests to an exposed rpc.statd service. Sustained requests can exhaust system resources, causing the service to degrade or crash. Defenders should prioritize verifying exposure of rpc.statd services and assessing system resource limitations.

Defensive priority

Defenders should prioritize verifying exposure of rpc.statd services and assessing system resource limitations.

Recommended defensive actions

• Verify exposure of rpc.statd services
• Assess system resource limitations
• Monitor for sustained notification requests
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Plan vendor-supported updates or mitigations

Evidence notes

The CVE description and NVD detail page provide information on the vulnerability. Additional verification is needed to confirm affected versions and remediation. Defenders should verify rpc.statd service exposure and assess system resource limitations. Evidence limits suggest that further review of nfs-utils and rpc.statd service configurations may be necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.