CVE-2026-89096

Name	CVE-2026-89096
Description	A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nfs-utils (PTS)	bookworm	1:2.6.2-4+deb12u1	vulnerable
	trixie	1:2.8.3-1	vulnerable
	forky, sid	1:3.1.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nfs-utils	source	(unstable)	1:3.1.1-1

Notes

[trixie] - nfs-utils <no-dsa> (Minor issue; potential update will be handled within kernel-team)
https://bugzilla.redhat.com/show_bug.cgi?id=2462372
Fixed by: https://git.linux-nfs.org/?p=steved/nfs-utils.git;a=commit;h=73cebb0d987cdaa8266b7db6fc6ca21bc59d1555 (nfs-utils-2-9-3-rc4)