CVE-2026-89092: GNU C Library nscd DOS Vulnerability

CVE-2026-89092 Overview

CVE-2026-89092 is a stack overflow vulnerability in the Name Service Cache Daemon (nscd) shipped with the GNU C Library (glibc) version 2.3.4 and later. A malicious Domain Name System (DNS) server can return an oversized response to a query issued through nscd, exhausting the thread stack and crashing the service. The flaw is categorized as [CWE-789: Memory Allocation with Excessive Size Value]. Exploitation requires the target system to have nscd enabled and configured to use an untrusted upstream DNS resolver. Successful triggering results in degraded name resolution rather than a full denial of service, since applications can fall back to direct resolver calls when nscd is unavailable.

Critical Impact
A crafted DNS response can crash the nscd thread and, under narrow conditions, corrupt other nscd cache entries by overwriting heap-adjacent memory before the process terminates.

Affected Products

GNU C Library (glibc) version 2.3.4 and later
Any Linux distribution shipping nscd from an affected glibc version
Systems configured to resolve names through an untrusted DNS server

Discovery Timeline

2026-09-11 - CVE-2026-89092 published to the National Vulnerability Database (NVD)
2026-09-11 - GLIBC-SA-2026-0016 advisory published by the glibc maintainers
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89092

Vulnerability Analysis

The nscd service caches responses from Name Service Switch (NSS) backends, including DNS, to reduce lookup latency. When processing a DNS response, the daemon allocates buffers on the thread stack proportional to the record size returned by the upstream resolver. A sufficiently large response consumes the entire stack region, crashing the worker thread. Because nscd typically runs isolated under its own service account without an interactive shell, any compromise is confined to the daemon itself. Application processes that would normally consult nscd continue to resolve names by calling the resolver library directly, which is why the maintainers characterize the outcome as performance degradation.

Root Cause

The root cause is unbounded stack allocation in the DNS response handling code path inside nscd. The service trusts the length fields supplied by the upstream DNS server and does not enforce an upper limit that fits within the fixed thread stack. When record sizes exceed the stack guard region, the write proceeds past the mapped stack and into adjacent memory before the process faults.

Attack Vector

The attack requires network adjacency to influence DNS responses and control of, or interposition on, the resolver that nscd queries. The attacker returns crafted responses whose record length triggers the oversized stack allocation. Stock BIND 9 was reportedly unable to serve records large enough to reproduce the crash during testing, but a custom or modified name server can do so. There is a remote possibility that stack corruption reaches the nscd cache heap and overwrites cached entries with attacker-influenced data before the daemon crashes.

No verified proof-of-concept code is available. For technical details, see the Sourceware Bug Report #34624 and the Sourceware GLIBC Security Advisory.

Detection Methods for CVE-2026-89092

Indicators of Compromise

Repeated nscd process crashes or systemd restart events for the nscd.service unit
Kernel log entries indicating a segmentation fault or stack overflow in an nscd worker thread
DNS response packets containing records approaching or exceeding typical resource record size limits
Sudden increase in direct resolver queries from applications after nscd becomes unavailable

Detection Strategies

Monitor journalctl -u nscd and /var/log/messages for repeated daemon terminations correlated with DNS activity
Inspect packet captures on port 53 for anomalously large UDP or TCP DNS responses from upstream resolvers
Alert on core dumps produced by the nscd binary and analyze the crashing stack frame for DNS parsing symbols
Compare cached entries returned by nscd -g against authoritative answers to identify potentially corrupted cache contents

Monitoring Recommendations

Track nscd uptime and restart count as a service-health metric feeding your Security Information and Event Management (SIEM) platform
Log the upstream resolvers configured in /etc/resolv.conf across the fleet and flag any pointing to untrusted networks
Baseline normal DNS response sizes at network egress and alert on outliers exceeding expected thresholds

How to Mitigate CVE-2026-89092

Immediate Actions Required

Apply the glibc update referenced in the GLIBC-SA-2026-0016 advisory as soon as your distribution publishes packages
Confirm that nscd uses only trusted DNS resolvers under administrative control
Restart the nscd service after patching to ensure the fixed code paths are loaded

Patch Information

The glibc maintainers have published GLIBC-SA-2026-0016 tracking the fix. Refer to the Sourceware Bug Report #34624 for commit references and to your Linux distribution's security tracker for backported package versions. Follow the Openwall OSS-Security Discussion for coordination details across downstream vendors.

Workarounds

Disable nscd on systems that do not require caching by running systemctl disable --now nscd, and rely on systemd-resolved or direct resolver calls
Restrict outbound DNS traffic so nscd can only reach vetted internal resolvers via firewall egress rules
Configure DNS Response Rate Limiting and size filtering at the recursive resolver to drop oversized responses before they reach clients

bash

# Configuration example: disable nscd where it is not required
sudo systemctl stop nscd.service
sudo systemctl disable nscd.service

# Alternatively, restrict nscd to trusted resolvers via /etc/resolv.conf
# nameserver 10.0.0.53
# options edns0 trust-ad