RHSA-2026:83562HighCVSS 7.5

Red Hat Security Advisory: rpcbind security update

Published
October 15, 2026
Last Modified
October 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-94640 →

📋 Description

CVE-2026-94640 — rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

🎯 Affected products14

  • Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-0:1.2.6-7.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-0:1.2.6-7.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-0:1.2.6-7.el9_8.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-0:1.2.6-7.el9_8.1.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-0:1.2.6-7.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-debuginfo-0:1.2.6-7.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-debuginfo-0:1.2.6-7.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-debuginfo-0:1.2.6-7.el9_8.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-debuginfo-0:1.2.6-7.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-debugsource-0:1.2.6-7.el9_8.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-debugsource-0:1.2.6-7.el9_8.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-debugsource-0:1.2.6-7.el9_8.1.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • rpcbind-debugsource-0:1.2.6-7.el9_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict network access to the `rpcbind` service on port 111 to trusted systems. This can be achieved by configuring firewall rules to limit inbound connections. For example, using `firewalld` on Red Hat Enterprise Linux: ```bash # To allow access only from a specific trusted network (e.g., 192.168.1.0/24) firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="111" protocol="tcp" accept' firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="111" protocol="udp" accept' firewall-cmd --reload ``` If `rpcbind` is only required for local services, ensure it is configured to listen only on the loopback interface or is otherwise protected from external network exposure. Applying these firewall rules will take effect immediately upon `firewall-cmd --reload` and may temporarily interrupt existing connections to `rpcbind`.

🔗 References (4)