USN-8997-1: Ubuntu patches DoS in Net-SNMP SMUX module

Ubuntu published security advisory USN-8997-1 on 4 November 2026 for a denial-of-service flaw in Net-SNMP, the most widely deployed package for SNMP monitoring on Linux servers. Anyone running snmpd exposed on the network for monitoring switches, storage arrays or other equipment should update shortly.

What the advisory says

According to Ubuntu, Net-SNMP through version 5.9.5.2 contains a denial-of-service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. In practice, a remote unauthenticated client can connect to the SMUX listener and send no data, causing snmpd's single-threaded main loop to hang indefinitely and suspend all SNMP processing.

The flaw, identified as CVE-2026-89147, has a CVSS 3.1 score of 7.5, classified as high. At the time of discovery, no known public exploits were reported.

Affected packages and fixed versions

Ubuntu Release	Packages	Fixed version
26.04 LTS (resolute)	libsnmp40t64, snmp, snmpd	5.9.4+dfsg-2ubuntu3.1
24.04 LTS (noble)	libsnmp40t64, snmp, snmpd	5.9.4+dfsg-1.1ubuntu3.3
22.04 LTS (jammy)	libsnmp40, snmp, snmpd	5.9.1+dfsg-1ubuntu2.10

A standard system update (apt update && apt upgrade) applies the fixes across all three releases.

Mitigation if you cannot update immediately

For those unable to apply the patch at once, a possible risk reduction is to disable the SMUX module if it is not needed, or restrict it to explicitly authorised management peers. The SMUX protocol (defined in RFC 1227) is used to register subagents with the main snmpd agent via TCP, and in many environments it is never used.

It is worth checking whether snmpd is exposed beyond localhost: if so, the risk window remains open until you update or disable the module.