CVE-2026-89539 - Vulnerability Details

- SUNRPC: reject duplicate CREDS_VALUE options

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: reject duplicate CREDS_VALUE options

gssx_dec_option_array() walks the wire-supplied option array and, for
every entry whose name matches CREDS_VALUE, calls
gssx_dec_linux_creds() on the same struct svc_cred. That helper
unconditionally installs a fresh groups_alloc() result into
creds->cr_group_info without releasing whatever pointer was already
there:

for (i = 0; i < count; i++) {
... decode name ...
if (length == sizeof(CREDS_VALUE) &&
memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {
err = gssx_dec_linux_creds(xdr, creds);
...
}
}

A reply that carries two CREDS_VALUE entries therefore overwrites
cr_group_info on the second iteration and orphans the group_info
allocated by the first call. The earlier free_creds path only
releases the last cr_group_info via free_svc_cred(), so the first
allocation's refcount stays at one and its kvmalloc-backed storage
is leaked. No in-tree caller of gssp_accept_sec_context_upcall()
expects more than one CREDS_VALUE per reply.

Fix by tracking whether a CREDS_VALUE option has already been
decoded and returning -EINVAL on any subsequent match, so the
free_creds path releases the single group_info that was installed.

Published: 2026-09-11

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability allows a crafted SUNRPC reply that contains two CREDS_VALUE options, each causing the kernel to reinstall the group information structure without freeing the previous allocation. This results in a kernel memory leak that can accumulate over time until the system runs out of memory, potentially causing a denial of service. The flaw does not expose user data or modify kernel integrity directly; it primarily reduces system availability.

Affected Systems

Linux kernels that have not incorporated. The issue resides in the kernel's handling of SUNRPC GSS authentication options.

Risk and Exploitability

An attacker can trigger the memory leak by sending a SUNRPC reply with duplicate CREDS_VALUE entries. The likely attack vector is remote exploitation of the GSS-based SUNRPC interface, though a local attacker with the ability to inject replies could also trigger the flaw. The EPSS score indicates an exploitation probability of less than 1% and the issue is not listed in the CISA KEV catalog, suggesting it is not actively targeted.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1d658336b05f8697d6445834f8867f8ad5e4f735`	affected	< f615b884310bf82d0014e3b5a92eb9aa88146685
`1d658336b05f8697d6445834f8867f8ad5e4f735`	affected	< 7a1d0501cbb962beba23377035d667bf3c1726ee
`1d658336b05f8697d6445834f8867f8ad5e4f735`	affected	< 9d94f046b23de0f77849ea69133063c949297e30
`1d658336b05f8697d6445834f8867f8ad5e4f735`	affected	< 2e4ce62385c1b8a887c5370af058ac7b52a8eaf9

Linux

affected

Version	Status	Constraints
`3.10`	affected	—
`0`	unaffected	< 3.10
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1d658336b05f8697d6445834f8867f8ad5e4f735,f615b884310bf82d0014e3b5a92eb9aa88146685)`	affected	code_commit	—
`[1d658336b05f8697d6445834f8867f8ad5e4f735,7a1d0501cbb962beba23377035d667bf3c1726ee)`	affected	code_commit	—
`[1d658336b05f8697d6445834f8867f8ad5e4f735,9d94f046b23de0f77849ea69133063c949297e30)`	affected	code_commit	—
`[1d658336b05f8697d6445834f8867f8ad5e4f735,2e4ce62385c1b8a887c5370af058ac7b52a8eaf9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.10`	affected	generic	—
`[0,3.10)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit that fixes the double-decoding issue.
If a kernel upgrade is not immediately possible, restrict or disable SUNRPC services that accept GSS authentication, or use firewall rules to block unsolicited RPC traffic.
Monitor kernel memory usage for abnormal increases that may indicate repeated exploitation of the leak.

Generated by OpenCVE AI on September 21, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2e4ce62385c1b8a887c5370af058ac7b52a8eaf9
https://git.kernel.org/stable/c/7a1d0501cbb962beba23377035d667bf3c1726ee
https://git.kernel.org/stable/c/9d94f046b23de0f77849ea69133063c949297e30
https://git.kernel.org/stable/c/f615b884310bf82d0014e3b5a92eb9aa88146685
https://nvd.nist.gov/vuln/detail/CVE-2026-89539
https://www.cve.org/CVERecord?id=CVE-2026-89539

History

Thu, 17 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89539 https://www.cve.org/CVERecord?id=CVE-2026-89539
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 14 Sep 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772

Mon, 14 Sep 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Sun, 13 Sep 2026 23:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Sun, 13 Sep 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-400 CWE-401

Sun, 13 Sep 2026 00:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400 CWE-401

Sat, 12 Sep 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Sat, 12 Sep 2026 07:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDS_VALUE options gssx_dec_option_array() walks the wire-supplied option array and, for every entry whose name matches CREDS_VALUE, calls gssx_dec_linux_creds() on the same struct svc_cred. That helper unconditionally installs a fresh groups_alloc() result into creds->cr_group_info without releasing whatever pointer was already there: for (i = 0; i < count; i++) { ... decode name ... if (length == sizeof(CREDS_VALUE) && memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) { err = gssx_dec_linux_creds(xdr, creds); ... } } A reply that carries two CREDS_VALUE entries therefore overwrites cr_group_info on the second iteration and orphans the group_info allocated by the first call. The earlier free_creds path only releases the last cr_group_info via free_svc_cred(), so the first allocation's refcount stays at one and its kvmalloc-backed storage is leaked. No in-tree caller of gssp_accept_sec_context_upcall() expects more than one CREDS_VALUE per reply. Fix by tracking whether a CREDS_VALUE option has already been decoded and returning -EINVAL on any subsequent match, so the free_creds path releases the single group_info that was installed.
Title		SUNRPC: reject duplicate CREDS_VALUE options
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2e4ce62385c1b8a887c5370af058ac7b52a8eaf9 https://git.kernel.org/stable/c/7a1d0501cbb962beba23377035d667bf3c1726ee https://git.kernel.org/stable/c/9d94f046b23de0f77849ea69133063c949297e30 https://git.kernel.org/stable/c/f615b884310bf82d0014e3b5a92eb9aa88146685

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:16.699Z

Updated: 2026-09-11T19:44:16.699Z

Reserved: 2026-09-11T19:38:34.721Z

Link: CVE-2026-89539

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:36.977

Modified: 2026-09-11T20:19:36.977

Link: CVE-2026-89539

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:16Z

Links: CVE-2026-89539 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:30:08Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object