CVE-2026-89092 The GNU C Library CVE debrief

Who should care

System administrators and security teams responsible for managing nscd services and DNS configurations should assess exposure and prioritize remediation. This is especially important for systems that have nscd enabled and are using an untrusted DNS server. The vulnerability can cause a stack overflow, leading to crashes and potential performance degradation in DNS resolution. System administrators and security teams should assess exposure, especially in  

Why it matters

This vulnerability in the GNU C Library's nscd service can cause a stack overflow, leading to crashes and potential performance degradation in DNS resolution. System administrators and security teams should assess exposure, especially in systems using nscd with untrusted DNS servers, and prioritize remediation to prevent potential issues.

• Potential performance degradation in DNS resolution due to nscd service crashes
• Possible cache corruption if an attacker manages to manipulate the stack pointer
• Isolated compromise of the nscd service, limited by its execution in an isolated context

Technical summary

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query. This can lead to potential performance degradation in DNS resolution. The vulnerability is caused by the nscd service's inability to handle large DNS responses, which can lead to a stack overflow and crash the service. The impact of this vulnerability is limited to systems that have nscd enabled and are using an untrusted DNS server. The nscd service is typically executed in an isolated context as its own user without a shell, which limits the potential damage.

Defensive priority

Assess exposure and prioritize remediation for systems using nscd with untrusted DNS servers.

Recommended defensive actions

• Assess nscd service exposure and usage of untrusted DNS servers
• Verify nscd service configuration and DNS server trustworthiness
• Monitor nscd service performance and logs for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its impact and remediation require further verification. The vulnerability is caused by a stack overflow in the nscd service, which can be triggered by a malicious DNS server returning a large response. The impact of this vulnerability is limited to systems that have nscd enabled and are using an untrusted DNS server. The nscd service is typically executed in an isolated context as its own user without a shell, which limits the potential damage. However, a remote  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.