CVE-2026-89542 - Vulnerability Details

- SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and
ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN
(16) bytes long, and its rotate_left() helper passes buf->len - base
to xdr_buf_subsegment() without verifying that base <= buf->len. When
a caller hands in a sub-16-byte token, or a token whose declared len
leaves base past the end of the buffer, three distinct failures follow:

gss_krb5_unwrap_v2(offset, len, buf)
ptr = buf->head[0].iov_base + offset
ec = *(ptr + 4) /* OOB read on short head */
rrc = *(ptr + 6) /* OOB read on short head */
rotate_left(offset + 16, buf, rrc)
xdr_buf_subsegment(buf, &subbuf,
base, buf->len - base) /* u32 wrap when base > len */
_rotate_left(&subbuf, shift)
shift %= buf->len /* divide-by-zero when base == len */

After decryption, the cleanup arithmetic has the same shape:

movelen = min_t(unsigned int, buf->head[0].iov_len, len);
movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
buf->head[0].iov_len);

The BUG_ON re-adds the value just subtracted, so it reduces to
min(A, B) > A and is permanently false; it cannot catch the unsigned
underflow of movelen, which then drives a ~UINT_MAX-byte memmove().

Add four defense-in-depth guards inside the unwrap core so it is safe
regardless of what its callers validate:

- reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before
touching ptr+4/ptr+6;
- bail from rotate_left() when buf->len <= base, covering both the
underflow and zero-length cases;
- return early from _rotate_left() when buf->len is zero, so the
shift %= buf->len modulo cannot fault;
- replace the dead BUG_ON with a live check that returns
GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability exploits an out‑of‑bounds read and subsequent unsigned underflow inside the Linux kernel’s SUNRPC GSS‑Kerberos decryption routine gss_krb5_unwrap_v2. A malicious token that is shorter than the required 16‑byte header causes the function to read beyond the buffer, triggers an unsigned underflow, and drives an oversized memmove that overwrites kernel memory. This allows an attacker to corrupt kernel data structures, potentially The weakness is identified as CWE‑125.

Affected Systems

All Linux kernel releases that include the SUNRPC implementation before the commit adding defensive checks to gss_krb5_unwrap_v2 are affected. The vulnerability is present in the kernel’s core SUNRPC code that parses GSS‑Kerberos tokens; no restricted product version list is provided, so any kernel older than the revision that hardens the routine is at risk.

Risk and Exploitability

The CVSS base score of 9.8 classifies this flaw as critical. The EPSS score of less than 1% indicates that strategic exploitation is currently unlikely, and the vulnerability is not listed in CISA KEV. Exploitation would require network access to a SUNRPC service that uses the vulnerable kernel function; a crafted short GSS‑Kerberos token would trigger the fault, allowing the attacker to corrupt kernel memory and obtain kernel‑level execution. The risk remains high, but widespread attacks are not yet observed.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< 299d281c7225ded15b28cb861a98d818d82787fc
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< 84ddbc8d084c0251d534f14f5d1a7da05be56404
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< 075d7cfc4df8c54cb202ba8b28420370c03ba9b6
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< f2591660e0eb263c9415bf0d0bb1b111e62df7a4
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< 806584a4b67a7233870c33e5b8f872e76dd02988
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< a7894e10572d53eb10109b8d07459cc8d3435811
`de9c17eb4a912c9028f7b470eb80815144883b26`	affected	< 6959297aaa9572783d620a226d73c3fb94494888

Linux

affected

Version	Status	Constraints
`2.6.35`	affected	—
`0`	unaffected	< 2.6.35
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[de9c17eb4a912c9028f7b470eb80815144883b26,dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087)`	affected	generic	—
`[de9c17eb4a912c9028f7b470eb80815144883b26,806584a4b67a7233870c33e5b8f872e76dd02988)`	affected	generic	—
`[de9c17eb4a912c9028f7b470eb80815144883b26,a7894e10572d53eb10109b8d07459cc8d3435811)`	affected	generic	—
`[de9c17eb4a912c9028f7b470eb80815144883b26,6959297aaa9572783d620a226d73c3fb94494888)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.35`	affected	semver	—
`[0,2.6.35)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the gss_krb5_unwrap_v2 patch, which adds in‑bounds checks and guards against the underflow.
If a kernel upgrade is not immediately possible, limit or disable the SUNRPC GSS‑Kerberos RPC service for untrusted networks, allowing only trusted hosts to connect.
Enable kernel logging and audit trails to capture out‑of‑bounds reads or BUG_ON events, and investigate any anomalies promptly.

Generated by OpenCVE AI on September 15, 2026 at 22:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00755.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6
https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc
https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888
https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988
https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404
https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811
https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087
https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4
https://nvd.nist.gov/vuln/detail/CVE-2026-89542
https://www.cve.org/CVERecord?id=CVE-2026-89542

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6 https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404 https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89542 https://www.cve.org/CVERecord?id=CVE-2026-89542
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN (16) bytes long, and its rotate_left() helper passes buf->len - base to xdr_buf_subsegment() without verifying that base <= buf->len. When a caller hands in a sub-16-byte token, or a token whose declared len leaves base past the end of the buffer, three distinct failures follow: gss_krb5_unwrap_v2(offset, len, buf) ptr = buf->head[0].iov_base + offset ec = (ptr + 4) / OOB read on short head / rrc = (ptr + 6) /* OOB read on short head / rotate_left(offset + 16, buf, rrc) xdr_buf_subsegment(buf, &subbuf, base, buf->len - base) / u32 wrap when base > len / _rotate_left(&subbuf, shift) shift %= buf->len / divide-by-zero when base == len */ After decryption, the cleanup arithmetic has the same shape: movelen = min_t(unsigned int, buf->head[0].iov_len, len); movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip; BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > buf->head[0].iov_len); The BUG_ON re-adds the value just subtracted, so it reduces to min(A, B) > A and is permanently false; it cannot catch the unsigned underflow of movelen, which then drives a ~UINT_MAX-byte memmove(). Add four defense-in-depth guards inside the unwrap core so it is safe regardless of what its callers validate: - reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before touching ptr+4/ptr+6; - bail from rotate_left() when buf->len <= base, covering both the underflow and zero-length cases; - return early from _rotate_left() when buf->len is zero, so the shift %= buf->len modulo cannot fault; - replace the dead BUG_ON with a live check that returns GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.
Title		SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888 https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988 https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811 https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:18.931Z

Updated: 2026-09-14T12:00:49.355Z

Reserved: 2026-09-11T19:38:34.722Z

Link: CVE-2026-89542

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:37.380

Modified: 2026-09-14T13:19:09.370

Link: CVE-2026-89542

Redhat

Severity : Important

Publid Date: 2026-09-11T19:44:18Z

Links: CVE-2026-89542 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:15:17Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object