CVE-2026-89544 - Vulnerability Details

- SUNRPC: fix gssx_dec_option_array error path bugs

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: fix gssx_dec_option_array error path bugs

Four coupled defects in the gssx XDR option-array decoder make the
error paths unsafe: a NULL deref in the caller, a refcount leak on
the decoded group_info, and a latent use-after-free that the leak
fix would otherwise expose.

gssx_dec_option_array() sets oa->count = 1 before allocating
oa->data. If that allocation fails, -ENOMEM is returned with
oa->count == 1 and oa->data == NULL. All other error paths jump
to free_oa: which frees oa->data and NULLs it but also leaves
oa->count == 1. The caller trusts the count:

gssp_accept_sec_context_upcall()
gssx_dec_accept_sec_context()
gssx_dec_option_array() /* fails, count=1 data=NULL */
data = res.options.data[0].value /* NULL deref */

Independently, free_creds: releases the partially decoded svc_cred
with a bare kfree(creds). gssx_dec_linux_creds() installs a
groups_alloc() result into creds->cr_group_info; that object is
kvmalloc-backed and refcounted, and only put_group_info() reaches
kvfree(). A plain kfree(creds) drops the wrapper and leaks the
group_info allocation.

The natural fix for the leak is to call free_svc_cred(creds) before
kfree(creds), but free_svc_cred() invokes put_group_info() on
creds->cr_group_info unconditionally when non-NULL. The existing
out_free_groups: path in gssx_dec_linux_creds() already called
groups_free() on that pointer without clearing it, so once
free_svc_cred() is wired in, the subsequent put_group_info() would
touch freed memory.

Fix all four together:

- Move the oa->count = 1 assignment below the oa->data allocation
so it is never set when oa->data is NULL.
- Reset oa->count to 0 at free_oa: so count and data stay
coherent and the caller sees an empty option array.
- Call free_svc_cred(creds) before kfree(creds) at free_creds:
so the refcounted cr_group_info is released. free_svc_cred()
either NULL-guards each field explicitly (cr_group_info has
an if() check) or delegates to a helper that is NULL-safe
itself (kfree for the string fields, gss_mech_put() which
guards with if(gm) at gss_mech_switch.c:342), so it is safe
to call on a partially decoded svc_cred where only
cr_uid/cr_gid/cr_group_info have been written and everything
else is zero from kzalloc.
- In gssx_dec_linux_creds()'s out_free_groups: path, release
cr_group_info with put_group_info() rather than groups_free()
so the teardown matches free_svc_cred()'s refcount-aware path,
and clear the pointer so a later free_svc_cred() on the same
creds does not release it a second time.

Published: 2026-09-11

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains four error‑path bugs in the SUNRPC gssx XDR option‑array decoder. A failure to allocate the data array sets the count to one, causing a NULL dereference when the caller later accesses the data. A separate bug leaks the partially decoded service credential’s group information reference count, and a latent use‑after‑free can occur when the credential is freed twice. These defects allow an attacker to corrupt kernel memory, potentially causing a system crash or enabling execution of arbitrary code with elevated privileges. The flaw involves a pointer dereference (CWE‑476).

Affected Systems

The generic Linux kernel’s SUNRPC subsystem is affected. Specific version information is not provided by the CNA, so the scope of impacted releases cannot be determined from the available data.

Risk and Exploitability

The CVSS score of 7.5 combined with an EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via crafted SUNRPC traffic sent to the affected subsystem from an untrusted source, which could lead to memory corruption or privilege escalation on the host.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3cfcfc102a5e57b021b786a755a38935e357797d`	affected	< fb30241f7ccace372ee83017891549f23a715581
`3cfcfc102a5e57b021b786a755a38935e357797d`	affected	< 3ff45361e9469e85c0f86b8e7b82c63e50bab8ef
`3cfcfc102a5e57b021b786a755a38935e357797d`	affected	< f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a
`3cfcfc102a5e57b021b786a755a38935e357797d`	affected	< 5e9a94539b1ec17a89177d952badfd0d844d694a
`b97c37978ca825557d331c9012e0c1ddc0e42364`	affected	—
`bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8`	affected	—
`bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8`	affected	—
`dd292e884c649f9b1c18af0ec75ca90b390cd044`	affected	—
`934212a623cbab851848b6de377eb476718c3e4c`	affected	—
`5e6013ae2c8d420faea553d363935f65badd32c3`	affected	—
`9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4`	affected	—
`996997d1fb2126feda550d6adcedcbd94911fc69`	affected	—
`4.19.311`	affected	< 4.20
`5.4.273`	affected	< 5.5
`5.10.214`	affected	< 5.11
`5.15.153`	affected	< 5.16
`6.1.83`	affected	< 6.2
`6.6.23`	affected	< 6.7
`6.7.11`	affected	< 6.8
`6.8.2`	affected	< 6.9

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.12.111`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3cfcfc102a5e57b021b786a755a38935e357797d,3ff45361e9469e85c0f86b8e7b82c63e50bab8ef)`	affected	code_commit	—
`[3cfcfc102a5e57b021b786a755a38935e357797d,f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a)`	affected	code_commit	—
`[3cfcfc102a5e57b021b786a755a38935e357797d,5e9a94539b1ec17a89177d952badfd0d844d694a)`	affected	code_commit	—
`b97c37978ca825557d331c9012e0c1ddc0e42364`	affected	code_commit	—
`bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8`	affected	code_commit	—
`bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8`	affected	code_commit	—
`dd292e884c649f9b1c18af0ec75ca90b390cd044`	affected	code_commit	—
`934212a623cbab851848b6de377eb476718c3e4c`	affected	code_commit	—
`5e6013ae2c8d420faea553d363935f65badd32c3`	affected	code_commit	—
`9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4`	affected	code_commit	—
`996997d1fb2126fedad550d6adcedcbd94911fc69`	affected	code_commit	—
`[4.19.311,4.20)`	affected	semver	—
`[5.4.273,5.5)`	affected	semver	—
`[5.10.214,5.11)`	affected	semver	—
`[5.15.153,5.16)`	affected	semver	—
`[6.1.83,6.2)`	affected	semver	—
`[6.6.23,6.7)`	affected	semver	—
`[6.7.11,6.8)`	affected	semver	—
`[6.8.2,6.9)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.9`	affected	semver	—
`[0,6.9)`	unaffected	semver	—
`[6.18.51,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest patched Linux kernel that includes the SUNRPC gssx decoder fix from the vendor.
Restrict inbound RPC traffic by configuring the firewall to block port 111 from untrusted networks or limit it to known hosts.
If a kernel update is not yet available, mitigate by disabling unnecessary SunRPC services such as rpcbind or restricting them to trusted networks.

Generated by OpenCVE AI on September 15, 2026 at 22:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00612.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3ff45361e9469e85c0f86b8e7b82c63e50bab8ef
https://git.kernel.org/stable/c/5e9a94539b1ec17a89177d952badfd0d844d694a
https://git.kernel.org/stable/c/f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a
https://git.kernel.org/stable/c/fb30241f7ccace372ee83017891549f23a715581
https://nvd.nist.gov/vuln/detail/CVE-2026-89544
https://www.cve.org/CVERecord?id=CVE-2026-89544

History

Mon, 21 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/fb30241f7ccace372ee83017891549f23a715581

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89544 https://www.cve.org/CVERecord?id=CVE-2026-89544
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose. gssx_dec_option_array() sets oa->count = 1 before allocating oa->data. If that allocation fails, -ENOMEM is returned with oa->count == 1 and oa->data == NULL. All other error paths jump to free_oa: which frees oa->data and NULLs it but also leaves oa->count == 1. The caller trusts the count: gssp_accept_sec_context_upcall() gssx_dec_accept_sec_context() gssx_dec_option_array() /* fails, count=1 data=NULL / data = res.options.data[0].value / NULL deref */ Independently, free_creds: releases the partially decoded svc_cred with a bare kfree(creds). gssx_dec_linux_creds() installs a groups_alloc() result into creds->cr_group_info; that object is kvmalloc-backed and refcounted, and only put_group_info() reaches kvfree(). A plain kfree(creds) drops the wrapper and leaks the group_info allocation. The natural fix for the leak is to call free_svc_cred(creds) before kfree(creds), but free_svc_cred() invokes put_group_info() on creds->cr_group_info unconditionally when non-NULL. The existing out_free_groups: path in gssx_dec_linux_creds() already called groups_free() on that pointer without clearing it, so once free_svc_cred() is wired in, the subsequent put_group_info() would touch freed memory. Fix all four together: - Move the oa->count = 1 assignment below the oa->data allocation so it is never set when oa->data is NULL. - Reset oa->count to 0 at free_oa: so count and data stay coherent and the caller sees an empty option array. - Call free_svc_cred(creds) before kfree(creds) at free_creds: so the refcounted cr_group_info is released. free_svc_cred() either NULL-guards each field explicitly (cr_group_info has an if() check) or delegates to a helper that is NULL-safe itself (kfree for the string fields, gss_mech_put() which guards with if(gm) at gss_mech_switch.c:342), so it is safe to call on a partially decoded svc_cred where only cr_uid/cr_gid/cr_group_info have been written and everything else is zero from kzalloc. - In gssx_dec_linux_creds()'s out_free_groups: path, release cr_group_info with put_group_info() rather than groups_free() so the teardown matches free_svc_cred()'s refcount-aware path, and clear the pointer so a later free_svc_cred() on the same creds does not release it a second time.
Title		SUNRPC: fix gssx_dec_option_array error path bugs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3ff45361e9469e85c0f86b8e7b82c63e50bab8ef https://git.kernel.org/stable/c/5e9a94539b1ec17a89177d952badfd0d844d694a https://git.kernel.org/stable/c/f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:20.424Z

Updated: 2026-09-21T13:14:24.848Z

Reserved: 2026-09-11T19:38:34.722Z

Link: CVE-2026-89544

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:37.670

Modified: 2026-09-21T14:17:22.970

Link: CVE-2026-89544

Redhat

Severity : Important

Publid Date: 2026-09-11T19:44:20Z

Links: CVE-2026-89544 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:15:17Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object