Denial of Service Vulnerability in nfs-utils Daemon by Red Hat
CVE-2026-89098

5.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
16 October 2026

What is CVE-2026-89098?

A security flaw in the nfs-utils package allows a local user to exploit issues in the fsidd daemon's input handling over local domain sockets. By submitting malformed requests that omit necessary command arguments, an attacker can trigger an assertion failure which leads to the daemon crashing. This results in a Denial of Service for filesystem identifier lookup functionalities until the daemon is manually restarted, disrupting services dependent on these lookup operations.

References

https://access.redhat.com/security/cve/CVE-2026-89098
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2469511
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.