CVE-2026-94640 Overview
CVE-2026-94640 is a resource exhaustion vulnerability in rpcbind, the service that maps Remote Procedure Call (RPC) program numbers to universal addresses on Unix-like systems. A remote, unauthenticated attacker can trigger a Denial of Service (DoS) by sending a large volume of unique RPC requests. The service records statistics for previously unseen requests in unbounded in-memory lists, causing persistent memory growth and rising CPU usage over time. The weakness is classified under CWE-400: Uncontrolled Resource Consumption.
Critical Impact
Sustained request flooding exhausts memory and CPU on the target host, degrading or halting availability of rpcbind and any RPC-dependent services such as NFS.
Affected Products
- rpcbind service on Linux distributions (see vendor advisories for exact package versions)
- Red Hat Enterprise Linux (per Red Hat CVE advisory)
- Systems exposing rpcbind (TCP/UDP port 111) to untrusted networks
Discovery Timeline
- 2026-09-22 - CVE-2026-94640 published to the National Vulnerability Database (NVD)
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-94640
Vulnerability Analysis
The flaw resides in the statistics-tracking code paths of rpcbind. When the service receives an RPC request, it records metadata about previously unseen requests to support tools such as rpcinfo. These records are appended to in-memory lists that have no upper bound and no eviction policy. An attacker who sends a continuous stream of requests with unique parameters forces the service to allocate new records indefinitely.
Memory usage grows linearly with the number of unique requests. CPU consumption also increases because list traversal cost scales with the length of the statistics structures. The behavior is deterministic and requires no authentication, no user interaction, and no local access.
Root Cause
The root cause is unbounded storage of RPC statistics. The service treats every unique request as a new record and never trims or caps the underlying data structures. This design assumes a bounded set of legitimate callers rather than a hostile input population, so an attacker can convert a diagnostic feature into a memory pressure primitive.
Attack Vector
Exploitation requires only network reachability to the rpcbind port (typically TCP and UDP 111). The attacker sends a high volume of RPC calls that vary program numbers, versions, procedure numbers, or transport parameters to defeat any deduplication. Over minutes to hours, the target process consumes available memory and eventually triggers out-of-memory conditions or scheduler starvation. No exploit is publicly indexed at the time of publication and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified proof-of-concept code has been published. See the Red Hat CVE-2026-94640 Advisory and Red Hat Bug Report #2462960 for vendor-provided technical detail.
Detection Methods for CVE-2026-94640
Indicators of Compromise
- Sustained growth of resident memory for the rpcbind process without a corresponding increase in legitimate RPC clients.
- High inbound packet rates to TCP or UDP port 111 originating from a small set of external sources.
- rpcinfo -p output showing an abnormally large number of tracked entries or slow response times.
- Out-of-memory kills of rpcbind recorded in /var/log/messages, journalctl, or dmesg.
Detection Strategies
- Baseline the normal memory footprint of rpcbind and alert on deviations beyond a defined threshold.
- Use packet capture or flow telemetry to identify request rates to port 111 that exceed operational norms.
- Correlate host-level resource alerts with network-layer volumetric anomalies to distinguish DoS activity from legitimate load.
Monitoring Recommendations
- Track rpcbind process metrics (RSS, CPU%, file descriptors) through Prometheus node_exporter, sar, or equivalent agents.
- Forward system logs and process metrics to a centralized analytics platform to detect gradual resource drift.
- Monitor firewall and NetFlow data for concentrated traffic to port 111 from untrusted address space.
How to Mitigate CVE-2026-94640
Immediate Actions Required
- Apply the vendor-supplied rpcbind update as soon as it is published by your distribution.
- Restrict inbound access to TCP and UDP port 111 to trusted management and NFS client networks only.
- Disable rpcbind on hosts that do not require RPC services such as NFS, NIS, or rpc.statd.
- Configure process resource limits (for example systemdMemoryMax=) so that a runaway rpcbind cannot destabilize the host.
Patch Information
Refer to the Red Hat CVE-2026-94640 Advisory and Red Hat Bug Report #2462960 for fixed package versions and downstream errata. Consult your Linux distribution's security tracker for the corresponding update in your environment.
Workarounds
- Enforce network-level access control via iptables, nftables, or firewalld to block untrusted sources from reaching port 111.
- Bind rpcbind to a specific internal interface using the -h option to reduce exposure.
- Apply rate limiting at perimeter devices to cap RPC request volume per source address.
- Restart rpcbind on a scheduled basis as a temporary measure to reclaim memory until the patch is deployed.
# Configuration example
# Restrict rpcbind to a management interface and rate-limit port 111
sudo sed -i 's|^OPTIONS=.*|OPTIONS="-w -h 10.0.0.5"|' /etc/sysconfig/rpcbind
sudo systemctl restart rpcbind
# nftables example: allow only trusted subnet, rate-limit the rest
sudo nft add rule inet filter input ip saddr 10.0.0.0/24 tcp dport 111 accept
sudo nft add rule inet filter input ip saddr 10.0.0.0/24 udp dport 111 accept
sudo nft add rule inet filter input tcp dport 111 limit rate 20/second accept
sudo nft add rule inet filter input udp dport 111 limit rate 20/second accept
sudo nft add rule inet filter input tcp dport 111 drop
sudo nft add rule inet filter input udp dport 111 drop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.