CVE-2026-89541 - Vulnerability Details

- SUNRPC: harden gss_unwrap_resp_priv length checks

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: harden gss_unwrap_resp_priv length checks

gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with

offset = (u8 *)(p) - (u8 *)head->iov_base;
if (offset + opaque_len > rcv_buf->len)
goto unwrap_failed;
maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
offset + opaque_len, rcv_buf);

Both operands are u32 and the sum is computed in u32. A reply with
opaque_len near 0xffffffff makes offset + opaque_len wrap to a small
value that is below rcv_buf->len, so the bound check passes and
gss_unwrap() is called with end < begin. The check also lacks a
lower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is
accepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt
header reads at ptr+4 and ptr+6 then run past the token.

A krb5p NFS server returning a crafted RPCSEC_GSS reply can drive
the client into out-of-bounds reads in gss_krb5_unwrap_v2() and the
rotate_left() loop that follows.

Fix by replacing the single combined check with three guards that
are safe in u32 arithmetic and that enforce the RFC 4121 minimum
outer token length:

if (offset > rcv_buf->len)
goto unwrap_failed;
if (opaque_len > rcv_buf->len - offset)
goto unwrap_failed;
if (opaque_len < GSS_KRB5_TOK_HDR_LEN)
goto unwrap_failed;

The first guard makes the subtraction in the second guard
unconditionally safe; offset is derived from a successful
xdr_inline_decode() in the head kvec, so in practice it already
satisfies the bound. The floor mirrors the server-side check added
in commit 5b757c2e57a5 ("SUNRPC: svcauth_gss: enforce krb5 token
minimum length").

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Binding the GSS-API token length with an unguarded 32‑bit sum allows an attacker to craft an RPCSEC_GSS reply whose opaque length wraps around so that the bounds check succeeds while the underlying pointer arithmetic overflows. This causes gss_krb5_unwrap_v2 to kernel memory or crashing the client. The flaw is a classic buffer over-read (CWE‑125).

Affected Systems

The vulnerability affects the Linux kernel for all users that run an NFS client capable of handling RPCSEC_GSS authentication. Versions of the kernel prior to the commit that introduced the three‑guard safeguard are impacted; the exact version range is not listed in the CV running before the included patch is vulnerable.

Risk and Exploitability

The CVSS score of 5.9 marks the issue as moderate, with the EPSS score being < 1% and no listing in the CISA KEV catalog. The exploit requires a remote attacker to control an NFS server that sends a specially crafted RPCSEC_GSS reply to a vulnerable client. While the vulnerability permits out-of-bounds reads, it does not directly enable code execution, but could lead to information disclosure or crash. Based on the available data, the likelihood is low, but the risk remains due to the remote nature of the attack vector.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2d2da60c63b67174add32f06e8d54c3a0c5cd9cf`	affected	< 89a15a50f84d32d4b99db86f957427fcbe20a99a
`2d2da60c63b67174add32f06e8d54c3a0c5cd9cf`	affected	< ebcbd2523a8524c3d24e111cdbed8e271d910269
`2d2da60c63b67174add32f06e8d54c3a0c5cd9cf`	affected	< d395c30d570ca6168f0297b191709927d1258273
`2d2da60c63b67174add32f06e8d54c3a0c5cd9cf`	affected	< 87831b92112c81db251d46756d65daa4f91af6a2

Linux

affected

Version	Status	Constraints
`2.6.15`	affected	—
`0`	unaffected	< 2.6.15
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes commit 5b757 which adds the three‑guard checks.
If an immediate kernel upgrade is not possible, reconfigure the NFS client to disable RPCSEC_GSS authentication or temporarily stop using NFS over the affected protocol.
Monitor NFS traffic for and apply network‑level filtering if suspicious activity is detected.

Generated by OpenCVE AI on September 13, 2026 at 05:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/87831b92112c81db251d46756d65daa4f91af6a2
https://git.kernel.org/stable/c/89a15a50f84d32d4b99db86f957427fcbe20a99a
https://git.kernel.org/stable/c/d395c30d570ca6168f0297b191709927d1258273
https://git.kernel.org/stable/c/ebcbd2523a8524c3d24e111cdbed8e271d910269
https://nvd.nist.gov/vuln/detail/CVE-2026-89541
https://www.cve.org/CVERecord?id=CVE-2026-89541

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89541 https://www.cve.org/CVERecord?id=CVE-2026-89541
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length checks gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with offset = (u8 )(p) - (u8 )head->iov_base; if (offset + opaque_len > rcv_buf->len) goto unwrap_failed; maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, offset + opaque_len, rcv_buf); Both operands are u32 and the sum is computed in u32. A reply with opaque_len near 0xffffffff makes offset + opaque_len wrap to a small value that is below rcv_buf->len, so the bound check passes and gss_unwrap() is called with end < begin. The check also lacks a lower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is accepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4 and ptr+6 then run past the token. A krb5p NFS server returning a crafted RPCSEC_GSS reply can drive the client into out-of-bounds reads in gss_krb5_unwrap_v2() and the rotate_left() loop that follows. Fix by replacing the single combined check with three guards that are safe in u32 arithmetic and that enforce the RFC 4121 minimum outer token length: if (offset > rcv_buf->len) goto unwrap_failed; if (opaque_len > rcv_buf->len - offset) goto unwrap_failed; if (opaque_len < GSS_KRB5_TOK_HDR_LEN) goto unwrap_failed; The first guard makes the subtraction in the second guard unconditionally safe; offset is derived from a successful xdr_inline_decode() in the head kvec, so in practice it already satisfies the bound. The floor mirrors the server-side check added in commit 5b757c2e57a5 ("SUNRPC: svcauth_gss: enforce krb5 token minimum length").
Title		SUNRPC: harden gss_unwrap_resp_priv length checks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/87831b92112c81db251d46756d65daa4f91af6a2 https://git.kernel.org/stable/c/89a15a50f84d32d4b99db86f957427fcbe20a99a https://git.kernel.org/stable/c/d395c30d570ca6168f0297b191709927d1258273 https://git.kernel.org/stable/c/ebcbd2523a8524c3d24e111cdbed8e271d910269

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:18.188Z

Updated: 2026-09-13T06:30:40.442Z

Reserved: 2026-09-11T19:38:34.721Z

Link: CVE-2026-89541

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:37.247

Modified: 2026-09-13T07:17:16.397

Link: CVE-2026-89541

Redhat

Severity : Important

Publid Date: 2026-09-11T19:44:18Z

Links: CVE-2026-89541 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T05:15:04Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object