CVE-2026-89537 - Vulnerability Details

- SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags
byte at ptr[2], and padding at ptr[3..7], then passes
ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().
None of these accesses check read_token->len first.

The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus
ctx->krb5e->cksum_len (12-24, depending on the enctype). All callers
accept shorter tokens from the wire:

- gss_unwrap_resp_integ() enforces only an upper bound
(offset + len <= rcv_buf->len) before allocating
mic.data = kmalloc(len) and passing it to gss_verify_mic().
A malicious NFS server can therefore supply a short checksum
opaque, producing a small slab allocation that the Kerberos MIC
verifier reads past.

- gss_validate() enforces only len <= RPC_MAX_AUTH_SIZE (400)
before passing the wire-supplied length to
gss_validate_seqno_mic(), which constructs a mic xdr_netobj
and calls gss_verify_mic().

- svcauth_gss_verify_header() enforces only
checksum.len >= XDR_UNIT (4 bytes) before dispatching to
gss_verify_mic().

- svcauth_gss_unwrap_integ() checks only that the checksum fits
in gsd->gsd_scratch.

Add a length guard at the top of gss_krb5_verify_mic_v2(), before any
ptr[] access or scatterlist construction. Well-formed MIC tokens from
gss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +
cksum_len bytes, so valid traffic is unaffected.

Published: 2026-09-11

Score: 9.1 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel's SUNRPC implementationgss_krb5_verify_mic_v2() routine. The code reads fields of a Kerberos MIC token (token ID, flags, padding) without first verifying that the supplied buffer is large enough (CWE-125). A malicious NFS server can send a short MIC token, causing the kernel to read past the end of the buffer, which can leak kernel memory. This vulnerability does not directly provide remote code execution but can be leveraged for further attacks.

Affected Systems

All Linux kernels released prior to the commit that added a length guard to gss_krb5_verify_mic_v2() are vulnerable. TheFS mounts, regardless of kernel minor version.

Risk and Exploitability

A likely attacker is a compromised or malicious NFS server that transmits malformed MIC tokens over the network. The CVSS score of 9.1 indicates high severity, while an EPSS score of <1% suggests exploitation is rare at present. Although the vulnerability is not in the CISA KEV catalog, the combination of network exposure and potential kernel memory disclosure still represents a significant risk for exposed servers.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< 7a946b2e7207f968902f2147ab9b30726f82f7ab
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< b94f6719dcd9f7a609bc5f459f85795900e77d25

Linux

affected

Version	Status	Constraints
`2.6.35`	affected	—
`0`	unaffected	< 2.6.35
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[de9c17eb4a912c9028f7b470eb80815144883b26,7a946b2e7207f968902f2147ab9b30726f82f7ab)`	affected	code_commit	—
`[de9c17eb4a912c9028f7b470eb80815144883b26,b94f6719dcd9f7a609bc5f459f85795900e77d25)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.35`	affected	semver	—
`[0,2.6.35)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit adding a length guard to gss_krb5_verify_mic_v2()
If a kernel upgrade cannot be performed immediately, disable GSS-based NFS mounts or restrict NFS client traffic to trusted hosts only
Deploy firewall rules or rate-limiting controls to block malformed MIC traffic from untrusted NFS sources

Generated by OpenCVE AI on September 15, 2026 at 22:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00539.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab
https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25
https://nvd.nist.gov/vuln/detail/CVE-2026-89537
https://www.cve.org/CVERecord?id=CVE-2026-89537

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}`	cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89537 https://www.cve.org/CVERecord?id=CVE-2026-89537
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first. The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus ctx->krb5e->cksum_len (12-24, depending on the enctype). All callers accept shorter tokens from the wire: - gss_unwrap_resp_integ() enforces only an upper bound (offset + len <= rcv_buf->len) before allocating mic.data = kmalloc(len) and passing it to gss_verify_mic(). A malicious NFS server can therefore supply a short checksum opaque, producing a small slab allocation that the Kerberos MIC verifier reads past. - gss_validate() enforces only len <= RPC_MAX_AUTH_SIZE (400) before passing the wire-supplied length to gss_validate_seqno_mic(), which constructs a mic xdr_netobj and calls gss_verify_mic(). - svcauth_gss_verify_header() enforces only checksum.len >= XDR_UNIT (4 bytes) before dispatching to gss_verify_mic(). - svcauth_gss_unwrap_integ() checks only that the checksum fits in gsd->gsd_scratch. Add a length guard at the top of gss_krb5_verify_mic_v2(), before any ptr[] access or scatterlist construction. Well-formed MIC tokens from gss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN + cksum_len bytes, so valid traffic is unaffected.
Title		SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:15.216Z

Updated: 2026-09-13T06:30:34.939Z

Reserved: 2026-09-11T19:38:34.721Z

Link: CVE-2026-89537

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:36.733

Modified: 2026-09-13T07:17:16.000

Link: CVE-2026-89537

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:15Z

Links: CVE-2026-89537 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:45:07Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object