CVE-2026-89098
MediumCVSS 5.5Summary
A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.
Risk Assessment
The daemon crash results in a Denial of Service (DoS) for filesystem identifier lookup services until it is restarted. This may disrupt operations of systems relying on NFS within the organization.
Recommendation
Update the nfs-utils package to a version containing the fix. Until deployment, consider restricting local access to the fsidd daemon socket.
Other vulnerabilities in nfs-utils
See all- CVE-2026-89096Medium
A flaw was found in nfs-utils where an unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth.
- CVE-2025-12801Medium
A vulnerability was discovered in the rpc.mountd daemon of the nfs-utils package for Linux, allowing an NFSv3 client to escalate privileges assigned in the /etc/exports file at mount time. This enables access to any subdirectory or subtree of an exported directory, regardless of file permissions and 'root_squash' or 'all_squash' attributes.
Original NVD description (English source)
A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS