Hi,

The following vulnerability was published for net-snmp.

CVE-2026-89147[0]:
| Net-SNMP through 5.9.5.2 contains a denial of service vulnerability
| in the SMUX module where smux_accept() performs an unauthenticated
| blocking read without timeout on newly accepted connections. An
| unauthenticated remote client can connect to the SMUX listener and
| send no data, causing the single-threaded snmpd main loop to block
| indefinitely and suspend all SNMP processing.

There is [1], but it is not immediately clear if it has been
reporterdd upstream.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-89147
https://www.cve.org/CVERecord?id=CVE-2026-89147
[1] https://gist.github.com/thesmartshadow/001cea595e75fed6aaea7389666dc9eb

Regards,
Salvatore

I've not seen anything in the upstream issue tracker.

Fortunately, Debian as shipped *and configured* is not immediately
vulnerable.
The analysis focused on the build-time configuration, not the run-time
configuration.

I was trying to reproduce it and nothing was listening on TCP port 199
The systemd service (and init script) have a run-time enabling of modules[2]

ExecStart=/usr/sbin/snmpd -LOw -u Debian-snmp -g Debian-snmp -I
-smux,mteTrigger,mteTriggerConf -f

The -I option specifies which modules are initialized unless the list is
preceded by - which makes it modules
we won't initialise. So, the smux (and the two mteTrigger) modules are not
started by a default Debian setup.

If smux is enabled, does snmpd hang? Yes, it does so definitely worthwhile
doing the fix.
I tried running an snmpwalk on the impacted agent and it didn't respond.

The reporter checked it on 5.9.3+dfsg-2+deb12u1 but I found the issue in
both
5.9.4+dfsg-2+deb13u1 and 5.9.5.2+dfsg-2.1+b2

 - Craig

[2]
https://salsa.debian.org/debian/net-snmp/-/blob/master/debian/snmpd.service?ref_type=heads#L9

Hello,

Bug #1147442 in net-snmp reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/net-snmp/-/commit/601118fdd393282671bb599f9e549c76cddaba0d
------------------------------------------------------------------------
Set timeout on smux socket

The smux socket has no timeout, so if someone connects and never sends
anything, snmpd hangs.

Fixes: CVE-2026-89147
Closes: #1147442

References:
https://gist.github.com/thesmartshadow/001cea595e75fed6aaea7389666dc9eb
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1147442

We believe that the bug you reported is fixed in the latest version of
net-snmp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147442@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Craig Small <csmall@debian.org> (supplier of updated net-snmp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 14 Sep 2026 18:18:22 +1000
Source: net-snmp
Architecture: source
Version: 5.9.5.2+dfsg-3
Distribution: unstable
Urgency: medium
Maintainer: Craig Small <csmall@debian.org>
Changed-By: Craig Small <csmall@debian.org>
Closes: 1104474 1106791 1132997 1137756 1147204 1147442
Changes:
 net-snmp (5.9.5.2+dfsg-3) unstable; urgency=medium
 .
   * Use systemd-sysusers for user creation !17
   * snmpd.conf: Only allow localhost by default Closes: #1132997
   * Update build-dep for libmariadb-dev Closes: #1137756
   * Add turkish translation for debconf Closes: #1104474
   * Also update net-snmp-create-user manpage path Closes: #1106791
   * libnl-route is a linux-only dependency Closes: #1147204
   * Added snmptls.1 man page
   * Remove kfreebsd build-deps
   * Set timeout on smux socket Fixes: CVE-2026-89147 Closes: #1147442
Checksums-Sha1:
 aa06f3c8f45f9b58852f690468ffd28eeaec197f 2576 net-snmp_5.9.5.2+dfsg-3.dsc
 2972c6212770c6a7108c3a9613076bbe87a48ff0 71920 net-snmp_5.9.5.2+dfsg-3.debian.tar.xz
 ae2aac84dc07179cac5d97231958e2776ba6963e 10547 net-snmp_5.9.5.2+dfsg-3_amd64.buildinfo
Checksums-Sha256:
 51cef89047f1adc6dee8c02cbfbd7d9a4f12cce441a7572a6bca00ee28f14d13 2576 net-snmp_5.9.5.2+dfsg-3.dsc
 52f9724c9a322d4ac093acd6d7e2cb6a1c2d6f5710a7d5478a0e160092af7eeb 71920 net-snmp_5.9.5.2+dfsg-3.debian.tar.xz
 3124a375068aa73ee6b2f8dff3bf3bda9a6d63a8290fe08335514c5896251d16 10547 net-snmp_5.9.5.2+dfsg-3_amd64.buildinfo
Files:
 cad63c987fe64a00371121027d321679 2576 net optional net-snmp_5.9.5.2+dfsg-3.dsc
 2c2491c15efd946ad8498c91d878d895 71920 net optional net-snmp_5.9.5.2+dfsg-3.debian.tar.xz
 af0467dfea9b36c800d07a61d0c3d96c 10547 net optional net-snmp_5.9.5.2+dfsg-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmqnrsEACgkQAiFmwP88
hOPKfA/8DF20gRX83nV8SzLUbcewpiMmyj8pbgIfxS+pokN+CuUAku6MFU8bIPCN
mzQxdIX/cZlJNfdpO56527UhPKGv+2u2+OYl85o2GdEfD6jcavsePXTetK4dJ6Ee
ykeEwSXDvGDlHWBy1d6V5f+OxxjhGU5M4RED8hb2JrpL2P0KeEuoGHbwB54fVnoE
j75LmQDxt/zPRrwzY4qt0t08r/Y3m4adrIMOs2VPtSezK8kR6Ev1W/T27gj8Qxc1
VU1SyEG3OzngtcLkQsUULrNwGLG521B31nw4/qNF9o4JIhNNw7ePR/9KaqOyCIkp
iqThEfgZrALjkeAWfchbIt0dnN1bb2vploCEy4nY+9ADMf/1ukLvvqtTJKb5AXfP
EFoIrdyZLbd4sSAMCdEwKwrbJ56lfQ2fIqXO+qvUmxXAgDOO55fWaqfggTTLMlL2
ZRKwerrOcGllPHCCsTb0OwAK1UaoQsXDJ3Vx9m0IkWJASyYrZdBd4+eD+N0I1/0w
HMCIv9o7VI+QhB9BAmCOeXdIgjD4DE7WY2ZYlT8kGySwfU2C+00bEdg6ihi8UEVI
wXxWbs+dOmuOOxMaSF0tGVJz2YHPs0RPzVDZsrY5FNE8GTEum9JJvDuvgOlkdk2n
LvxL7n2h+fFNBH9ctYyhL6vNd2u8xIWPTqqfxBOCSrEMZAo/pwU=
=VWDx
-----END PGP SIGNATURE-----