CVE-2026-89096

Executive Summary

CVE-2026-89096 is a memory-exhaustion denial-of-service vulnerability in the rpc.statd daemon shipped with the Linux nfs-utils package. An unauthenticated remote attacker who can reach the RPC service can send repeated state notification requests, causing memory allocated during callback processing to accumulate without being released. Sustained traffic steadily grows the daemon's memory footprint and can degrade or crash the service, disrupting NFS lock and state recovery for all NFS clients that depend on it.

Technical Analysis

The vulnerability is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). rpc.statd is the Network Status Monitor (NSM) component of the NFS stack. It tracks host state so that NFS lock recovery can occur after a peer restart, and it performs callbacks to monitored peers as part of that state-notification workflow. The NVD description states that the service "fails to properly release memory allocated during callback processing" when handling state notification requests, and that repeating these requests produces "continuous memory growth."

From a mechanism standpoint, the flaw is a resource-lifecycle defect rather than a corruption bug: each inbound state-notification request causes the daemon to allocate memory for callback processing, and that allocation is not freed on the corresponding completion/error path. Because the requests are processed by a network-facing RPC service and require no authentication, any host with network reachability to rpc.statd can drive the leak. The leak is cumulative and monotonic — there is no single-request crash primitive. Resource exhaustion is reached only after sufficient request volume, which is consistent with the CVSS temporal characteristics of high attack complexity (AC:H): the attacker must sustain traffic long enough to consume available memory, and success depends on request rate versus available memory and any restart/watchdog behavior on the host.

Specific implementation details — the exact callback processing routine, allocator used, and structure sizes — are not disclosed in the available data. No affected version range, patch commit, or code reference is available from any tracked source.

The exposure precondition is network reachability to the statd RPC endpoint. rpc.statd traditionally listens on a dynamically assigned high port registered with rpcbind, meaning exposure typically arises when rpcbind/portmapper and the statd port are reachable across a network boundary — for example, a host with NFS exported to untrusted networks, or a firewall that permits the rpcbind port without restricting the dynamically assigned statd port.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available. The attack chain below is inferred from the vulnerability class and the NVD description only.

1. Reconnaissance / target identification. The attacker scans for hosts exposing the rpcbind/portmapper service and enumerates registered RPC programs to identify hosts running the NFS NSM (rpc.statd) service. Internet-wide scanning for exposed rpcbind is routine and low-noise; an exposed statd endpoint on an NFS server or client is the target indicator.

2. Triggering the flaw class. With the statd endpoint identified and reachable, the attacker sends state notification requests to the service repeatedly. Per the description, each request causes memory to be allocated for callback processing and not released. No credentials are required (PR:N), and no user interaction is needed (UI:N).

3. Execution method at the vulnerability-class level. The attack is a resource-consumption / memory-leak pattern, not code execution. The attacker's only requirement is sustained request volume against the callback-processing path — a slow, repeatable flood of state notification requests. The attacker does not need to supply malformed data; the leak occurs on normal request handling.

4. Post-exploitation impact. This is availability-only. As memory grows, the daemon and potentially the host suffer resource pressure, leading to service degradation or crash. Because rpc.statd underpins NFS lock/state recovery, a crash of statd can disrupt lock recovery and state notification for dependent NFS clients, and a host under memory pressure can affect co-resident services. There is no confidentiality or integrity impact (C:N/I:N) and no scope change (S:U) per the CVSS vector. No data exfiltration or lateral movement is enabled by this flaw itself.

Impact Assessment

Per the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), the base score of 5.9 reflects a network-reachable, unauthenticated availability attack that requires sustained effort (high complexity) and yields a high availability impact with no confidentiality or integrity consequences. The blast radius is concentrated on NFS-dependent infrastructure: any environment where rpc.statd is reachable from untrusted network segments — NFS servers, NFS clients running statd locally, and hosts with permissive rpcbind exposure — is at risk. Business impact is service disruption: stalled or failed NFS lock recovery, interrupted state notification, and potential host-level instability from memory exhaustion. Because the flaw is unpatched and requires no authentication, exposed deployments are effectively permanently at risk until network exposure is removed or the daemon is replaced. EPSS has not been scored by FIRST.org, so no exploitation-likelihood estimate is available. The CVE is not in CISA KEV and no in-the-wild exploitation is known from the provided data.

Detection Guidance

Sigma Rule

title: rpc.statd Memory Exhaustion via Repeated State Notification Requests
id: 8f3c2a10-6b7e-4d2a-9c1e-nfsstatd772
status: experimental
description: Detects anomalous resource growth and restart behavior of rpc.statd consistent with CVE-2026-89096 memory leak abuse (CWE-772).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89096
author: valtersit.com
logsource:
  product: linux
  service: auditd
detection:
  selection_statd:
    comm: 'rpc.statd'
  selection_mem_or_exit:
    type:
      - 'OOM'
      - 'EXEC'
    exe|endswith: '/rpc.statd'
  condition: selection_statd and selection_mem_or_exit
falsepositives:
  - Legitimate statd restarts during package upgrades
  - Kernel OOM events unrelated to statd
level: medium
tags:
  - attack.t1499
  - cwe.772

YARA Rule

rule CVE_2026_89096_rpcstatd_memory_leak_indicator
{
    meta:
        description = "Heuristic indicator for host artifacts of rpc.statd memory exhaustion abuse (CVE-2026-89096)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89096"
        cwe = "CWE-772"
    strings:
        $s1 = "rpc.statd" ascii wide nocase
        $s2 = "statd" ascii wide nocase
        $oom1 = "Out of memory" ascii nocase
        $oom2 = "oom-kill" ascii nocase
    condition:
        ($s1 or $s2) and ($oom1 or $oom2)
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-89096 Possible rpc.statd State Notification Flood (NSM)"; content:"|00 00 00 00|"; depth:4; byte_test:4,=,0,24; flow:stateless; threshold: type both, track by_src, count 100, seconds 60; sid:8909601; rev:1; classtype:attempted-dos; reference:cve,2026-89096; metadata: created_at 2026, cve CVE-2026-89096, cwe CWE-772;)

Note: RPC payload inspection is protocol-dependent and the statd program number/port are environment-specific. Deploy this as a rate-based volumetric detector for repeated NSM RPC traffic toward a statd host, adjusting the byte_test offset to match observed traffic; treat it as a tuning baseline rather than an exact signature.

Elastic Detection

sequence by host.id with maxspan=10m
  [process where event.type == "start" and process.name == "rpc.statd"]
  [process where event.type == "end" and process.name == "rpc.statd"]

Use alongside host memory telemetry (system.memory.actual.used.pct) rising on NFS servers to correlate repeated statd restarts with memory exhaustion.

Splunk SPL Query

index=linux sourcetype=linux_secure OR sourcetype=syslog ("rpc.statd" OR "statd")
| stats count AS restart_events, values(host) AS hosts BY host
| where restart_events > 3

Correlate with kernel OOM logs:

index=linux ("rpc.statd" AND ("killed process" OR "Out of memory"))
| table _time host _raw

Wazuh OSSEC Rule

<group name="nfs-utils,rpc-statd,"
  <rule id="890960" level="10">
    <decoded_as>syslog</decoded_as>
    <match>rpc.statd</match>
    <regex>Out of memory|oom-kill|killed process</regex>
    <description>CVE-2026-89096: possible rpc.statd memory exhaustion / OOM event</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cwe_772,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data is available; treat all deployed rpc.statd instances as potentially affected.

1. Immediate mitigations:

   • Block inbound access to the statd RPC endpoint from untrusted networks. Restrict the rpcbind port and statd's dynamically assigned port to trusted NFS peer ranges only; this removes the unauthenticated remote attack surface entirely.
   • Where NFSv4 is in use, NFSv4 does not require NSM/rpc.statd — disable/decommission the daemon where it is not needed.
   • Deploy rate limiting at the network boundary toward exposed rpcbind/statd hosts to blunt sustained request floods.
   • Add host memory-pressure monitoring and OOM watchdog alerting for NFS servers so leak-driven growth is caught before service degradation.
   • Consider a supervised restart policy for rpc.statd to bound the leak's lifetime, while monitoring for repeated restarts as an attack indicator.

2. Patch/upgrade steps: No patch is available. Monitor the nfs-utils project and your distribution vendor (e.g., linux-nfs mailing list, distro security advisories) for a fixed release. Once a patched version is published, upgrade nfs-utils and restart rpc.statd; do not apply unverified third-party builds.

3. Long-term hardening: Enforce network segmentation for NFS infrastructure with default-deny firewall policy; inventory and eliminate internet-exposed rpcbind endpoints; deploy memory-consumption detection on all hosts running NFS services; adopt a policy of tracking nfs-utils release notes for NSM-related defects.

References

• NVD — CVE-2026-89096: https://nvd.nist.gov/vuln/detail/CVE-2026-89096
• MITRE CWE-772 — Missing Release of Resource after Effective Lifetime: https://cwe.mitre.org/data/definitions/772.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• nfs-utils project (Linux NFS utilities, upstream source for rpc.statd): https://linux-nfs.org/
• CISA Known Exploited Vulnerabilities Catalog (check for inclusion): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or in-the-wild exploitation are known from the provided data; CVE-2026-89096 is not listed in CISA KEV and has no public PoC or exploit code.