CVE-2026-89092: Stack overflow in nscd due to unbounded alloca use
The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.
Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack. During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server. In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.
There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.
Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed?
Systems are exposed when nscd is enabled and name resolution uses an untrusted DNS server. The DNS server must be compromised or malicious and able to return records large enough to overflow an nscd thread stack.
Does exploitation require authentication or user interaction?
No authentication or user interaction is described. Exploitation depends on the attacker controlling a DNS server used by the affected system and on that server being able to process and return sufficiently large DNS records.
What is the expected impact of a successful attack?
The primary outcome is an nscd crash and degraded DNS-resolution performance. The description states that this does not result in a denial of service; cache corruption is described as a remote possibility if the attacker can manipulate the stack pointer into a desired heap location.
How much does nscd isolation limit the impact?
In typical installations, nscd runs isolated under its own user account without a shell, so compromise of the service is isolated. This limits the impact of a service compromise, although DNS-resolution degradation can still occur after a crash.