nfs-utils CVE-2026-89098

Requires the fsidd daemon to be running and the attacker to have local access to its Unix domain socket as a user permitted to write to it - this is not a default state on most hosts, since fsidd is only active when NFS is configured to use a filesystem-identifier database/daemon rather than static fsid assignment. Exploitation is limited by AV:L (no remote reachability) and PR:L (the attacker must already be an authenticated local user with socket access); there is no user interaction and no cross-system impact. Defenders can further restrict risk via socket file permissions and by running fsidd under a supervisor that auto-restarts it, which shortens the DoS window.

This is a genuine but low-urgency issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and CWE-617 (reachable assertion) agree internally with the description: a local, already-authenticated user can crash the fsidd daemon by sending a malformed request to its local domain socket, producing an availability-only impact with no confidentiality or integrity loss. All signals point in the same direction rather than conflicting - there is no scope change (S:U) and no remote reachability (AV:L), which bounds blast radius to the single host. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied in the input, so exploitation-likelihood signals are entirely absent rather than low; this means no automatable/wormable assessment can be made. The practical ceiling on severity is that an attacker must already have local access and the privileges to reach the socket, and the worst outcome is a restartable DoS of filesystem-identifier lookups - not code execution or privilege escalation. Net: a legitimately rated MEDIUM, worth patching on normal maintenance cadence, not an emergency.

A local user with access to the fsidd daemon's domain socket sends a crafted request that omits the required arguments the daemon expects. Because argument validation relies on program assertions rather than graceful error handling, the assertion fails and the daemon aborts, denying filesystem identifier lookups until an administrator restarts it. No public exploit is referenced in the input, and exploitation is confined to local access per the CVSS attack vector.