---
id: "CVE-2026-89096"
kind: "vulnerability"
aliases: ["CVE-2026-89096"]
title: "nfs-utils: rpc.statd memory leak lets remote users exhaust resources"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux", "nfs-servers", "nfs-utils", "self-hosted"]
not_affected_if: ["no-network-exposure", "statd-disabled"]
published_at: "2026-10-16T23:17:02+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:09:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89096", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# nfs-utils: rpc.statd memory leak lets remote users exhaust resources

nfs-utils rpc.statd leaks memory during callback processing when it receives repeated state notification requests. A remote unauthenticated attacker can grow memory use until the service degrades or crashes, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `rpm -q nfs-utils` or `dpkg -s nfs-utils` to read the installed version
- Check whether rpc.statd is running and reachable from the network, for example with `rpcinfo -p` and `ss -lntup | grep -i statd`
- Fixed version: unknown

## Fix

- Update nfs-utils to a fixed release from your distribution; the fixed version is unknown from the sources
- Block untrusted network access to rpc.statd until patched, for example with a firewall rule on the statd port

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89096

## From the sources

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_