CVE-2026-89544 (GCVE-0-2026-89544)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30
VLAI
Title
SUNRPC: fix gssx_dec_option_array error path bugs
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose. gssx_dec_option_array() sets oa->count = 1 before allocating oa->data. If that allocation fails, -ENOMEM is returned with oa->count == 1 and oa->data == NULL. All other error paths jump to free_oa: which frees oa->data and NULLs it but also leaves oa->count == 1. The caller trusts the count: gssp_accept_sec_context_upcall() gssx_dec_accept_sec_context() gssx_dec_option_array() /* fails, count=1 data=NULL */ data = res.options.data[0].value /* NULL deref */ Independently, free_creds: releases the partially decoded svc_cred with a bare kfree(creds). gssx_dec_linux_creds() installs a groups_alloc() result into creds->cr_group_info; that object is kvmalloc-backed and refcounted, and only put_group_info() reaches kvfree(). A plain kfree(creds) drops the wrapper and leaks the group_info allocation. The natural fix for the leak is to call free_svc_cred(creds) before kfree(creds), but free_svc_cred() invokes put_group_info() on creds->cr_group_info unconditionally when non-NULL. The existing out_free_groups: path in gssx_dec_linux_creds() already called groups_free() on that pointer without clearing it, so once free_svc_cred() is wired in, the subsequent put_group_info() would touch freed memory. Fix all four together: - Move the oa->count = 1 assignment below the oa->data allocation so it is never set when oa->data is NULL. - Reset oa->count to 0 at free_oa: so count and data stay coherent and the caller sees an empty option array. - Call free_svc_cred(creds) before kfree(creds) at free_creds: so the refcounted cr_group_info is released. free_svc_cred() either NULL-guards each field explicitly (cr_group_info has an if() check) or delegates to a helper that is NULL-safe itself (kfree for the string fields, gss_mech_put() which guards with if(gm) at gss_mech_switch.c:342), so it is safe to call on a partially decoded svc_cred where only cr_uid/cr_gid/cr_group_info have been written and everything else is zero from kzalloc. - In gssx_dec_linux_creds()'s out_free_groups: path, release cr_group_info with put_group_info() rather than groups_free() so the teardown matches free_svc_cred()'s refcount-aware path, and clear the pointer so a later free_svc_cred() on the same creds does not release it a second time.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3cfcfc102a5e57b021b786a755a38935e357797d , < 3ff45361e9469e85c0f86b8e7b82c63e50bab8ef (git)
Affected: 3cfcfc102a5e57b021b786a755a38935e357797d , < f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a (git)
Affected: 3cfcfc102a5e57b021b786a755a38935e357797d , < 5e9a94539b1ec17a89177d952badfd0d844d694a (git)
Affected: b97c37978ca825557d331c9012e0c1ddc0e42364 (git)
Affected: bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8 (git)
Affected: bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8 (git)
Affected: dd292e884c649f9b1c18af0ec75ca90b390cd044 (git)
Affected: 934212a623cbab851848b6de377eb476718c3e4c (git)
Affected: 5e6013ae2c8d420faea553d363935f65badd32c3 (git)
Affected: 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4 (git)
Affected: 996997d1fb2126feda550d6adcedcbd94911fc69 (git)
Affected: 4.19.311 , < 4.20 (semver)
Affected: 5.4.273 , < 5.5 (semver)
Affected: 5.10.214 , < 5.11 (semver)
Affected: 5.15.153 , < 5.16 (semver)
Affected: 6.1.83 , < 6.2 (semver)
Affected: 6.6.23 , < 6.7 (semver)
Affected: 6.7.11 , < 6.8 (semver)
Affected: 6.8.2 , < 6.9 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_rpc_xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ff45361e9469e85c0f86b8e7b82c63e50bab8ef",
              "status": "affected",
              "version": "3cfcfc102a5e57b021b786a755a38935e357797d",
              "versionType": "git"
            },
            {
              "lessThan": "f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a",
              "status": "affected",
              "version": "3cfcfc102a5e57b021b786a755a38935e357797d",
              "versionType": "git"
            },
            {
              "lessThan": "5e9a94539b1ec17a89177d952badfd0d844d694a",
              "status": "affected",
              "version": "3cfcfc102a5e57b021b786a755a38935e357797d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b97c37978ca825557d331c9012e0c1ddc0e42364",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dd292e884c649f9b1c18af0ec75ca90b390cd044",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "934212a623cbab851848b6de377eb476718c3e4c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5e6013ae2c8d420faea553d363935f65badd32c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "996997d1fb2126feda550d6adcedcbd94911fc69",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.311",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.273",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_rpc_xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.311",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.273",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.214",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.153",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.83",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: fix gssx_dec_option_array error path bugs\n\nFour coupled defects in the gssx XDR option-array decoder make the\nerror paths unsafe: a NULL deref in the caller, a refcount leak on\nthe decoded group_info, and a latent use-after-free that the leak\nfix would otherwise expose.\n\ngssx_dec_option_array() sets oa-\u003ecount = 1 before allocating\noa-\u003edata.  If that allocation fails, -ENOMEM is returned with\noa-\u003ecount == 1 and oa-\u003edata == NULL.  All other error paths jump\nto free_oa: which frees oa-\u003edata and NULLs it but also leaves\noa-\u003ecount == 1.  The caller trusts the count:\n\n    gssp_accept_sec_context_upcall()\n      gssx_dec_accept_sec_context()\n        gssx_dec_option_array()        /* fails, count=1 data=NULL */\n      data = res.options.data[0].value /* NULL deref */\n\nIndependently, free_creds: releases the partially decoded svc_cred\nwith a bare kfree(creds).  gssx_dec_linux_creds() installs a\ngroups_alloc() result into creds-\u003ecr_group_info; that object is\nkvmalloc-backed and refcounted, and only put_group_info() reaches\nkvfree().  A plain kfree(creds) drops the wrapper and leaks the\ngroup_info allocation.\n\nThe natural fix for the leak is to call free_svc_cred(creds) before\nkfree(creds), but free_svc_cred() invokes put_group_info() on\ncreds-\u003ecr_group_info unconditionally when non-NULL.  The existing\nout_free_groups: path in gssx_dec_linux_creds() already called\ngroups_free() on that pointer without clearing it, so once\nfree_svc_cred() is wired in, the subsequent put_group_info() would\ntouch freed memory.\n\nFix all four together:\n\n  - Move the oa-\u003ecount = 1 assignment below the oa-\u003edata allocation\n    so it is never set when oa-\u003edata is NULL.\n  - Reset oa-\u003ecount to 0 at free_oa: so count and data stay\n    coherent and the caller sees an empty option array.\n  - Call free_svc_cred(creds) before kfree(creds) at free_creds:\n    so the refcounted cr_group_info is released.  free_svc_cred()\n    either NULL-guards each field explicitly (cr_group_info has\n    an if() check) or delegates to a helper that is NULL-safe\n    itself (kfree for the string fields, gss_mech_put() which\n    guards with if(gm) at gss_mech_switch.c:342), so it is safe\n    to call on a partially decoded svc_cred where only\n    cr_uid/cr_gid/cr_group_info have been written and everything\n    else is zero from kzalloc.\n  - In gssx_dec_linux_creds()\u0027s out_free_groups: path, release\n    cr_group_info with put_group_info() rather than groups_free()\n    so the teardown matches free_svc_cred()\u0027s refcount-aware path,\n    and clear the pointer so a later free_svc_cred() on the same\n    creds does not release it a second time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The decoder runs only as a consequence of an RPCSEC_GSS_INIT/CONTINUE_INIT Call to in-kernel nfsd (and other SUNRPC servers such as lockd) on the network, typically TCP/2049. A remote client drives svcauth_gss_proxy_init() \u2192 gssp_accept_sec_context_upcall() \u2192 gssx_dec_option_array(); the attacker\u2019s reach is purely over the network.\nAC:L - Any allocation or XDR error after oa-\u003ecount is set to 1 leaves count=1 with data=NULL, and the caller always indexes res.options.data[0]. The attacker can induce those failures by flooding pre-auth GSS_INIT upcalls that each pin 256 KB of receive pages (especially under memcg-limited nfsd) and by driving large group-list replies, so success does not depend on conditions beyond their control.\nPR:N - svcauth_gss_proxy_init() runs from svcauth_gss_proc_init() on the first RPCSEC_GSS handshake leg, before the kernel has validated any Kerberos ticket. The upcall and option-array decode execute for an unauthenticated NFS client; no local account or prior credential on the server is required.\nUI:N - The crash is triggered entirely by an inbound RPC to an already-running nfsd/SUNRPC service thread. No administrator or end-user action such as mounting a filesystem or opening a file is required.\nS:U - The NULL dereference and group_info leak occur inside the host kernel\u2019s SUNRPC/GSS code. Impact stays within that kernel\u2019s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - With oa-\u003ecount==1 and oa-\u003edata==NULL, gssp_accept_sec_context_upcall() does \u0026res.options.data[0].value, a NULL+small-offset load that faults on the unmapped zero page. No kernel memory is returned to the attacker; unlike a UAF, freed object contents are never read.\nI:N - The faulting access is a pure NULL-pointer dereference with no kernel write. The put_group_info() UAF described in the fix is only latent: the unpatched free_creds path kfree()s the svc_cred wrapper without touching cr_group_info, so the dangling pointer is not used.\nA:H - The NULL dereference oopses the nfsd (or lockd) thread and panics the host where panic_on_oops is set, which is typical on NAS/appliance NFS servers. The same error path also leaks the kvmalloc-backed group_info, and the crash can be repeated to take down SUNRPC service threads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:43.148Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ff45361e9469e85c0f86b8e7b82c63e50bab8ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e9a94539b1ec17a89177d952badfd0d844d694a"
        }
      ],
      "title": "SUNRPC: fix gssx_dec_option_array error path bugs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89544",
    "datePublished": "2026-09-11T19:44:20.424Z",
    "dateReserved": "2026-09-11T19:38:34.722Z",
    "dateUpdated": "2026-09-13T06:30:43.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89544",
      "date": "2026-09-15",
      "epss": "0.00567",
      "percentile": "0.4535"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T15:02:20.000Z",
      "cve": "CVE-2026-89544",
      "id": "msrc_CVE-2026-89544",
      "initial_release_date": "2026-09-13T01:14:17.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "SUNRPC: fix gssx_dec_option_array error path bugs",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89544.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89544\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:37.670\",\"lastModified\":\"2026-09-13T07:17:16.673\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: fix gssx_dec_option_array error path bugs\\n\\nFour coupled defects in the gssx XDR option-array decoder make the\\nerror paths unsafe: a NULL deref in the caller, a refcount leak on\\nthe decoded group_info, and a latent use-after-free that the leak\\nfix would otherwise expose.\\n\\ngssx_dec_option_array() sets oa-\u003ecount = 1 before allocating\\noa-\u003edata.  If that allocation fails, -ENOMEM is returned with\\noa-\u003ecount == 1 and oa-\u003edata == NULL.  All other error paths jump\\nto free_oa: which frees oa-\u003edata and NULLs it but also leaves\\noa-\u003ecount == 1.  The caller trusts the count:\\n\\n    gssp_accept_sec_context_upcall()\\n      gssx_dec_accept_sec_context()\\n        gssx_dec_option_array()        /* fails, count=1 data=NULL */\\n      data = res.options.data[0].value /* NULL deref */\\n\\nIndependently, free_creds: releases the partially decoded svc_cred\\nwith a bare kfree(creds).  gssx_dec_linux_creds() installs a\\ngroups_alloc() result into creds-\u003ecr_group_info; that object is\\nkvmalloc-backed and refcounted, and only put_group_info() reaches\\nkvfree().  A plain kfree(creds) drops the wrapper and leaks the\\ngroup_info allocation.\\n\\nThe natural fix for the leak is to call free_svc_cred(creds) before\\nkfree(creds), but free_svc_cred() invokes put_group_info() on\\ncreds-\u003ecr_group_info unconditionally when non-NULL.  The existing\\nout_free_groups: path in gssx_dec_linux_creds() already called\\ngroups_free() on that pointer without clearing it, so once\\nfree_svc_cred() is wired in, the subsequent put_group_info() would\\ntouch freed memory.\\n\\nFix all four together:\\n\\n  - Move the oa-\u003ecount = 1 assignment below the oa-\u003edata allocation\\n    so it is never set when oa-\u003edata is NULL.\\n  - Reset oa-\u003ecount to 0 at free_oa: so count and data stay\\n    coherent and the caller sees an empty option array.\\n  - Call free_svc_cred(creds) before kfree(creds) at free_creds:\\n    so the refcounted cr_group_info is released.  free_svc_cred()\\n    either NULL-guards each field explicitly (cr_group_info has\\n    an if() check) or delegates to a helper that is NULL-safe\\n    itself (kfree for the string fields, gss_mech_put() which\\n    guards with if(gm) at gss_mech_switch.c:342), so it is safe\\n    to call on a partially decoded svc_cred where only\\n    cr_uid/cr_gid/cr_group_info have been written and everything\\n    else is zero from kzalloc.\\n  - In gssx_dec_linux_creds()\u0027s out_free_groups: path, release\\n    cr_group_info with put_group_info() rather than groups_free()\\n    so the teardown matches free_svc_cred()\u0027s refcount-aware path,\\n    and clear the pointer so a later free_svc_cred() on the same\\n    creds does not release it a second time.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/auth_gss/gss_rpc_xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3cfcfc102a5e57b021b786a755a38935e357797d\",\"lessThan\":\"3ff45361e9469e85c0f86b8e7b82c63e50bab8ef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3cfcfc102a5e57b021b786a755a38935e357797d\",\"lessThan\":\"f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3cfcfc102a5e57b021b786a755a38935e357797d\",\"lessThan\":\"5e9a94539b1ec17a89177d952badfd0d844d694a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b97c37978ca825557d331c9012e0c1ddc0e42364\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dd292e884c649f9b1c18af0ec75ca90b390cd044\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"934212a623cbab851848b6de377eb476718c3e4c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e6013ae2c8d420faea553d363935f65badd32c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"996997d1fb2126feda550d6adcedcbd94911fc69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.19.311\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.273\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.214\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.153\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.83\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.23\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.7.11\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.8.2\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/auth_gss/gss_rpc_xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3ff45361e9469e85c0f86b8e7b82c63e50bab8ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e9a94539b1ec17a89177d952badfd0d844d694a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T17:36:51+00:00",
      "cve": "CVE-2026-89544",
      "id": "CVE-2026-89544",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "233",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: SUNRPC: fix gssx_dec_option_array error path bugs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89544.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T23:36:40Z",
      "cve": "CVE-2026-89544",
      "id": "CVE-2026-89544",
      "initial_release_date": "2026-09-12T16:26:18Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89544",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89544.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.