nfs-utils EUVD-2026-103204

Exploitation requires a running and network-reachable rpc.statd (the NSM status monitor used for NFSv3 file-locking recovery) that accepts state-notification requests from the attacker; the memory leak is in callback processing of these requests. Limiting factors: rpc.statd only runs when NFSv3 locking services are active, and it is normally bound to internal/trusted networks rather than exposed to the internet, so default or firewalled deployments are not reachable. Per CVSS no authentication (PR:N) or user interaction (UI:N) is needed, but AC:H reflects that a single request is insufficient - the attacker must sustain repeated requests long enough to exhaust memory, and impact is limited to availability (C:N/I:N/A:H) with recovery via service restart.

This is a genuine but moderate-priority availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9 MEDIUM) describes an unauthenticated, network-reachable flaw whose only impact is availability - there is no confidentiality or integrity loss (C:N/I:N). The AC:H rating is the key dampener: exploitation is not a single crafted packet but requires sustained, repeated state-notification requests to gradually exhaust memory via the CWE-772 resource leak, so the attack must be maintained over time and its success depends on target memory capacity and monitoring. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or widespread exploitation - consistent with 'no public exploit identified at time of analysis.' SSVC-style reasoning: technical impact is partial (service degradation/crash, recoverable by restart, no code execution or data exposure), and the attack is only semi-automatable given the need for sustained traffic. The practical risk is almost entirely gated by exposure: rpc.statd is dangerous only when reachable from untrusted networks, which is a non-default, discouraged deployment posture. Net: patch on a normal maintenance cadence and verify statd is not internet-exposed; this does not warrant out-of-band emergency response.

An attacker with network reachability to a host running an exposed rpc.statd service sends a continuous, high-volume stream of state notification (NSM/SM_NOTIFY-style) requests. Because the service fails to free memory allocated during callback processing, its resident memory grows steadily until the service degrades, is OOM-killed, or the host becomes unstable, disrupting NFSv3 file locking and dependent clients. No public exploit code was identified in the provided data, and the high attack complexity means the flood must be sustained to realize impact.