CVE-2026-16277 Overview
CVE-2026-16277 is a stack-based buffer overflow [CWE-121] in the rpcinfo utility shipped with rpcbind. When a client runs rpcinfo -l against a remote rpcbind service, address information returned by the server is copied into a fixed-size stack buffer without adequate bounds checking. A malicious or compromised rpcbind server can return oversized address data to corrupt the client's stack and crash the process. The result is a denial of service against the querying client. The vulnerability affects system availability only, with no impact to confidentiality or integrity.
Critical Impact
A hostile rpcbind server can crash any client that runs rpcinfo -l against it, disrupting NFS and RPC administrative workflows.
Affected Products
- rpcbind package (rpcinfo utility) as distributed by Linux vendors
- Red Hat Enterprise Linux (see Red Hat CVE advisory for affected streams)
- Linux From Scratch builds using upstream rpcbind
Discovery Timeline
- 2026-07-20 - CVE-2026-16277 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-16277
Vulnerability Analysis
The flaw resides in the client-side handling of RPC address strings inside rpcinfo. When invoked with the -l (list) option, rpcinfo queries a remote rpcbind daemon and iterates over the returned program mappings. For each entry the server returns a universal address string that the client copies into a fixed-size stack buffer to format for display.
Because the copy does not validate the length of the server-supplied address against the destination buffer size, an attacker who controls the rpcbind service can return an oversized address field. Writing past the buffer corrupts adjacent stack memory, including saved return addresses and frame pointers, and crashes the rpcinfo client. The vulnerability requires user interaction: an administrator or automated task must execute rpcinfo -l against the malicious endpoint.
Root Cause
The root cause is missing bounds enforcement when copying server-supplied address strings into a fixed-size stack buffer inside rpcinfo. This is a classic instance of [CWE-121] Stack-Based Buffer Overflow. The upstream fix in the Linux NFS repository (rpcbind commit bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d) adds proper length validation before the copy operation.
Attack Vector
Exploitation requires a client to voluntarily query an attacker-controlled rpcbind server. The attacker configures the server to return crafted universal address strings that exceed the client's destination buffer. When the target runs rpcinfo -l <attacker_host>, the oversized data overflows the stack buffer and terminates the process. The attack is network-based, requires no authentication, but does require user interaction. Confidentiality and integrity are not impacted; only availability of the querying process is affected.
See the Red Hat CVE Advisory and Linux NFS Commit Diff for source-level details.
Detection Methods for CVE-2026-16277
Indicators of Compromise
- Unexpected crashes or SIGSEGV signals from the rpcinfo process on administrator or monitoring hosts
- Core dumps referencing rpcinfo with corrupted stack frames after outbound queries to untrusted RPC endpoints
- Outbound connections from monitoring or NFS management hosts to unknown rpcbind services on TCP/UDP port 111
Detection Strategies
- Monitor host telemetry for abnormal termination of rpcinfo processes and correlate with the destination host queried
- Inspect audit logs for invocations of rpcinfo -l targeting hosts outside the trusted RPC inventory
- Alert on rpcbind protocol responses containing unusually long universal address strings via network detection tooling
Monitoring Recommendations
- Enable process crash telemetry and core dump collection on hosts that regularly run rpcinfo scripts
- Review scheduled tasks and monitoring jobs that call rpcinfo against remote endpoints and constrain them to known-good targets
- Restrict outbound access to TCP/UDP port 111 to an allowlist of trusted internal RPC servers
How to Mitigate CVE-2026-16277
Immediate Actions Required
- Apply the rpcbind package update from your Linux distribution as soon as it is available
- Audit scripts, cron jobs, and monitoring agents that invoke rpcinfo -l and remove queries to untrusted hosts
- Block outbound port 111 traffic at the network perimeter to prevent queries against attacker-controlled rpcbind services
Patch Information
The upstream fix is available in the Linux NFS rpcbind repository as commit bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d. Distribution-specific packages should be installed as they are released. Track vendor status via the Red Hat CVE Advisory, the Red Hat Bug Report, and the Linux From Scratch Advisory.
Workarounds
- Avoid running rpcinfo -l against hosts outside a trusted inventory until the patched package is installed
- Use host-based firewall rules to restrict outbound RPC portmapper queries to known internal servers
- Replace ad hoc rpcinfo diagnostic scripts with tooling that validates the destination host against an allowlist before querying
# Configuration example: restrict outbound rpcbind queries with iptables
iptables -A OUTPUT -p tcp --dport 111 -d 10.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -p udp --dport 111 -d 10.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 111 -j REJECT
iptables -A OUTPUT -p udp --dport 111 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
