{"id":"CVE-2026-89098","aliases":["AZL-109794","BELL-CVE-2026-89098","DEBIAN-CVE-2026-89098","EUVD-2026-103016","GHSA-7q29-687q-4m44","UBUNTU-CVE-2026-89098"],"status":"published","title":"Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd","description":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00147,"percentile":0.03953,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2026-10-16T17:43:21Z","modified":"2026-11-07T14:16:15Z","fixes":[{"ecosystem":"Azure Linux:3","package":"nfs-utils","fixed_in":["2.6.4-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nfs-utils","fixed_in":["1:3.1.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-5"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.4-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.6.2-4","1:2.6.2-4+deb12u1","1:2.6.3-1","1:2.6.3-1~exp1","1:2.6.3-2","1:2.6.3-3","1:2.6.3-4~exp1","1:2.6.4-1","1:2.6.4-1~exp1","1:2.6.4-2","1:2.6.4-3","1:2.6.4-4","1:2.6.4-5","1:2.6.4-6","1:2.7.1-1","1:2.7.1-1~exp1","1:2.7.1-2","1:2.7.1-3","1:2.8.1-1","1:2.8.1-1~exp1","1:2.8.1-2","1:2.8.2-1","1:2.8.2-2","1:2.8.2-2~exp1","1:2.8.2-3","1:2.8.3-1","1:2.8.3-1~exp1","1:2.8.4-1","1:2.8.4-2","1:2.8.5-1","1:2.8.6-1","1:2.8.7-1","1:2.9.1-1","1:2.9.2-1","1:3.1.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.8.3-1","1:2.8.4-1","1:2.8.4-2","1:2.8.5-1","1:2.8.6-1","1:2.8.7-1","1:2.9.1-1","1:2.9.2-1","1:3.1.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1.1-1"}]}],"versions":["1:2.8.3-1","1:2.8.4-1","1:2.8.4-2","1:2.8.5-1","1:2.8.6-1","1:2.8.7-1","1:2.9.1-1","1:2.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.8-2ubuntu2","1:1.2.8-4ubuntu1","1:1.2.8-5ubuntu1","1:1.2.8-6ubuntu1","1:1.2.8-6ubuntu1.1","1:1.2.8-6ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.2.8-9ubuntu10","1:1.2.8-9ubuntu11","1:1.2.8-9ubuntu12","1:1.2.8-9ubuntu12.1","1:1.2.8-9ubuntu12.2","1:1.2.8-9ubuntu12.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.3.4-2.1ubuntu2","1:1.3.4-2.1ubuntu4","1:1.3.4-2.1ubuntu5","1:1.3.4-2.1ubuntu5.1","1:1.3.4-2.1ubuntu5.2","1:1.3.4-2.1ubuntu5.3","1:1.3.4-2.1ubuntu5.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.3.4-2.5ubuntu2","1:1.3.4-2.5ubuntu3","1:1.3.4-2.5ubuntu3.1","1:1.3.4-2.5ubuntu3.3","1:1.3.4-2.5ubuntu3.4","1:1.3.4-2.5ubuntu3.5","1:1.3.4-2.5ubuntu3.6","1:1.3.4-2.5ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.3.4-6ubuntu1","1:2.6.1-1~exp1ubuntu1","1:2.6.1-1ubuntu1","1:2.6.1-1ubuntu1.1","1:2.6.1-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.6.3-3ubuntu1","1:2.6.4-3ubuntu3","1:2.6.4-3ubuntu4","1:2.6.4-3ubuntu5","1:2.6.4-3ubuntu5.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.8.5-1ubuntu1","1:2.9.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.8.3-1ubuntu3","1:2.8.4-1ubuntu1","1:2.8.5-1ubuntu1"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-89098","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2469511","tags":["issue-tracking","x_refsource_REDHAT","exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89098","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7q29-687q-4m44"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-89098","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-89098","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-89098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89098","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-89098","title":"Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd","description":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.","status":"published","published":"2026-10-16T17:43:21.72Z","modified":"2026-11-06T01:13:54.145Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-06T02:55:55.947181Z"}],"euvd":[{"id":"EUVD-2026-103016","description":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.","status":"published","published":"2026-10-16T17:43:21Z","modified":"2026-11-06T01:13:54Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-7q29-687q-4m44","title":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local...","description":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.","status":"published","published":"2026-10-16T18:34:57Z","modified":"2026-10-16T18:35:03Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:13:52.91817Z"}],"nvd":[{"id":"CVE-2026-89098","description":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.","status":"published","published":"2026-10-16T18:19:42.32Z","modified":"2026-11-06T02:17:56.17Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-06T06:59:06.002832Z"}],"osv":[{"id":"BELL-CVE-2026-89098","status":"published","published":"2026-10-17T06:05:38.318003Z","modified":"2026-10-28T07:15:03.449739534Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"DEBIAN-CVE-2026-89098","description":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.","status":"published","published":"2026-10-16T18:19:42.32Z","modified":"2026-10-23T17:47:22.310487467Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"UBUNTU-CVE-2026-89098","description":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.","status":"published","published":"2026-10-16T18:19:00Z","modified":"2026-10-28T20:17:35.826978311Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"AZL-109794","title":"CVE-2026-89098 affecting package nfs-utils for versions less than 2.6.4-5","description":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.","status":"published","published":"2026-10-16T18:19:42Z","modified":"2026-11-07T14:16:15.062523443Z","updated_at":"2026-11-07T14:48:25.680996Z"}]}}