Red Hat Fixes Unbounded Memory Allocation in rpcbind Allowing Unauthenticated Remote Denial of Service
Red Hat has published advisory RHSA-2026:83562, an Important-rated security update for the rpcbind package on Red Hat Enterprise Linux 9, released and last updated on 15 October 2026. The update addresses CVE-2026-94640, described by the vendor as an unbounded memory allocation in rpcbind's statistics tracking that allows an unauthenticated remote attacker to cause a denial of service. rpcbind is the service that converts Remote Procedure Call program numbers into universal addresses, and it must be running on a host before RPC calls can be served from that machine, which makes it a common fixture on file-serving and legacy middleware systems. The affected product list is broad and covers every mainstream RHEL 9 architecture — x86_64, IBM z Systems s390x, Power little-endian ppc64le and ARM 64 aarch64 — along with the 9.8 Extended Update Support, Update Services for SAP Solutions, four-years-of-updates and Extended Life Cycle channels. The fixed build is rpcbind-1.2.6-7.el9_8.1, published as a source RPM plus binary, debuginfo and debugsource packages for each architecture, and the issue is tracked internally as Bugzilla 2462960.
Red Hat's errata confines its technical description to a single-line summary of the defect, and no deeper mechanism, reproduction detail or proof-of-concept code is given in the advisory text. What the vendor does state plainly is the shape of the problem: the code path that maintains rpcbind's statistics allocates memory without an upper bound, and that path is reachable by a remote party who holds no credentials and needs no prior foothold, with the resulting impact being denial of service. Red Hat directs readers to the individual CVE page for the CVSS base score, impact statement and acknowledgements rather than reproducing them in the errata text, and the issue is tracked in Bugzilla as 2462960. The fix is already shipping through the normal errata channels as rpcbind-1.2.6-7.el9_8.1, and Red Hat Insights patch analysis is offered to identify which registered systems in an estate still carry the vulnerable package.
The strategic weight of this update comes from where rpcbind tends to live rather than from the sophistication of the bug. It is frequently enabled alongside NFS and other RPC-dependent services on storage servers, SAP application hosts and long-lived legacy systems, exactly the class of machine that tends to be left running untouched and that other systems depend on for availability. The impact here is confined to availability — there is no indication in the advisory of data disclosure, data modification or code execution — but a daemon that can be pushed into unbounded allocation by an unauthenticated peer can drag a shared host into memory pressure that affects unrelated workloads on the same box. The presence of this errata across the Extended Update Support, SAP Solutions and Extended Life Cycle streams signals that Red Hat expects the vulnerable package to be present on production estates that move slowly by design. On current exploitation status, FIRST's EPSS model puts CVE-2026-94640 at a 0.4% probability of exploitation in the next 30 days, and no public reporting places this flaw in active attacks; that is a low-urgency signal, not a guarantee, and it may shift if exploitation details become public.
Attack Surface
Server OS, Infrastructure
Tactics
Impact
Techniques
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Update rpcbind to version 1.2.6-7.el9_8.1 or later on all Red Hat Enterprise Linux 9 hosts (dnf update rpcbind), covering x86_64, s390x, ppc64le and aarch64 builds shipped under RHSA-2026:83562.
- Include the 9.8 Extended Update Support, Update Services for SAP Solutions, four-years-of-updates and Extended Life Cycle channels in the patch sweep, as RHSA-2026:83562 ships rpcbind-1.2.6-7.el9_8.1 to all of them and these estates are commonly excluded from routine patch windows.
- Use the Red Hat Insights patch analysis for RHSA-2026:83562 to enumerate which registered systems still carry a vulnerable rpcbind build, rather than relying on manual inventory of RPC-enabled hosts.
- Stop and mask rpcbind on hosts that do not serve NFS or other RPC services: systemctl disable –now rpcbind.service rpcbind.socket, which removes the attack surface for CVE-2026-94640 entirely on those machines.
- Restrict the rpcbind listener on TCP and UDP port 111 to trusted management and storage subnets with firewalld, for example firewall-cmd –permanent –zone=internal –add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=111 protocol=tcp accept' plus the matching udp rule, then firewall-cmd –permanent –zone=public –remove-service=rpc-bind and firewall-cmd –reload, so unauthenticated external hosts cannot reach the affected code path.
- Alert on sustained resident memory growth of the rpcbind process and on out-of-memory kills naming rpcbind in journalctl or /var/log/messages, as unbounded allocation would surface first as memory pressure on the serving host.
- Verify downloaded packages against the SHA-256 values published in the errata before deployment, for example c06f54d9c22ef6e30b0e24d93821ceb7dc2fcbce9901240bc56d2e2d0537d8c8 for rpcbind-1.2.6-7.el9_8.1.src.rpm.
