--- title: "CVE-2026-89092\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2026-89092?format=md keywords: index, follow --- # CVE-2026-89092 Publication date 14 September 2026 Last updated 14 September 2026 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **4.2 · Medium** [Score breakdown](https://ubuntu.com/security/CVE-2026-89092?format=md#impact-score) Toggle side navigation ## Description The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | glibc | 26.04 LTS resolute | Needs evaluation | | 24.04 LTS noble | Needs evaluation | | 22.04 LTS jammy | Needs evaluation | | 20.04 LTS focal | Needs evaluation | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Needs evaluation | | eglibc | 26.04 LTS resolute | Not in release | | 24.04 LTS noble | Not in release | | 22.04 LTS jammy | Not in release | | 14.04 LTS trusty | Needs evaluation | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 4.2 · Medium * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Adjacent | | Attack complexity | High | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | Low | | Availability impact | Low | * Scores | Parameter | Value | | --- | --- | | Base score | 4.2 · Medium | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89092) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-89092) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-89092) * [Debian](https://security-tracker.debian.org/tracker/CVE-2026-89092) ### Other references * * * * *