GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89550 (GCVE-0-2026-89550)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:00
VLAI
Title
SUNRPC: svcauth_gss: enforce krb5 token minimum length
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unwrap_priv() validates only an upper bound on the wire-supplied opaque length before handing the buffer to gss_unwrap(): if (len > xdr_stream_remaining(xdr)) goto unwrap_failed; offset = xdr_stream_pos(xdr); ... maj_stat = gss_unwrap(ctx, offset, offset + len, buf); The wire value `len` flows unchanged as the upper bound into the krb5 unwrap path, so a len in [0, 16] passes this check and is handed to gss_unwrap(). For a krb5 v2 context that lands in gss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token header fields at ptr+4 and ptr+6 and then calls rotate_left() before any integrity check. With a sub-header length the header reads run past the token, and _rotate_left()'s `shift %= buf->len` path can divide by zero when buf->len has been driven to zero by the truncated token. A header-only token (len == 16) is equally invalid: with a non-zero RRC field and the opaque blob ending at the XDR buffer boundary, rotate_left() builds a zero-length subbuffer, reaching the same division. Reject the token at the server entry point before it reaches the krb5 unwrap core. A valid sealed RFC 4121 token must contain the 16-byte header plus at least some encrypted payload. Fix by adding a minimum-length check immediately after the existing upper-bound check: if (len <= GSS_KRB5_TOK_HDR_LEN) goto unwrap_failed;
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7c9fdcfb1b64c47ed618c103b617af3f86e1239c , < 0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd (git)
Affected: 7c9fdcfb1b64c47ed618c103b617af3f86e1239c , < dd6afc6cab8c5d387d1ed2f069562ef7bdadd651 (git)
Affected: 7c9fdcfb1b64c47ed618c103b617af3f86e1239c , < de942dd8c2c8358bcad04ce44271954c48924423 (git)
Affected: 7c9fdcfb1b64c47ed618c103b617af3f86e1239c , < 2eed1e6a976a44015c3ee78841fe336796e2b21c (git)
Affected: 7c9fdcfb1b64c47ed618c103b617af3f86e1239c , < a919c5c88769cf8fb3ec071e6078d830bf512489 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.18
Unaffected: 0 , < 2.6.18 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/svcauth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            },
            {
              "lessThan": "dd6afc6cab8c5d387d1ed2f069562ef7bdadd651",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            },
            {
              "lessThan": "de942dd8c2c8358bcad04ce44271954c48924423",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            },
            {
              "lessThan": "2eed1e6a976a44015c3ee78841fe336796e2b21c",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            },
            {
              "lessThan": "a919c5c88769cf8fb3ec071e6078d830bf512489",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/svcauth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: svcauth_gss: enforce krb5 token minimum length\n\nsvcauth_gss_unwrap_priv() validates only an upper bound on the\nwire-supplied opaque length before handing the buffer to\ngss_unwrap():\n\n    if (len \u003e xdr_stream_remaining(xdr))\n            goto unwrap_failed;\n    offset = xdr_stream_pos(xdr);\n    ...\n    maj_stat = gss_unwrap(ctx, offset, offset + len, buf);\n\nThe wire value `len` flows unchanged as the upper bound into the\nkrb5 unwrap path, so a len in [0, 16] passes this check and is\nhanded to gss_unwrap(). For a krb5 v2 context that lands in\ngss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token\nheader fields at ptr+4 and ptr+6 and then calls rotate_left()\nbefore any integrity check. With a sub-header length the header\nreads run past the token, and _rotate_left()\u0027s `shift %= buf-\u003elen`\npath can divide by zero when buf-\u003elen has been driven to zero by\nthe truncated token. A header-only token (len == 16) is equally\ninvalid: with a non-zero RRC field and the opaque blob ending at\nthe XDR buffer boundary, rotate_left() builds a zero-length\nsubbuffer, reaching the same division.\n\nReject the token at the server entry point before it reaches the\nkrb5 unwrap core. A valid sealed RFC 4121 token must contain\nthe 16-byte header plus at least some encrypted payload.\n\nFix by adding a minimum-length check immediately after the\nexisting upper-bound check:\n\n    if (len \u003c= GSS_KRB5_TOK_HDR_LEN)\n            goto unwrap_failed;"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcauth_gss_unwrap_priv() is reached from in-kernel nfsd over TCP/2049 (svc_authenticate \u2192 svcauth_gss_accept) and from the NFSv4.0 RPC_AUTH_GSS callback service, so a remote RPCSEC_GSS peer delivers the short krb5 wrap token over the network.\nAC:L - A single RPCSEC_GSS DATA Call with gc_svc=PRIVACY and opaque length in [0, 16] plus a non-zero RRC in the cleartext RFC 4121 header deterministically hits gss_krb5_unwrap_v2() rotate_left() u32 wrap and shift%=0; no race or attacker-uncontrollable layout is required.\nPR:N - A malicious NFS server that already shares a krb5p GSS context can send a crafted NFSv4.0 GSS callback into the client\u0027s svcauth_gss_unwrap_priv() with no account or capability on the victim. That peer path is the highest-severity reachability.\nUI:N - nfsd unwraps the Call in the service thread with no local user action. On the client, the NFSv4.0 GSS callback path runs from the callback service thread once an NFS/RPCSEC_GSS mount exists; no additional mount, click, or open is required at attack time.\nS:U - The out-of-bounds accesses, divide-by-zero, and underflowed memmove corrupt host kernel SUNRPC/GSS state on the machine processing the RPC. This is ordinary same-host kernel impact, not a VM escape, IOMMU bypass, or other changed-scope boundary.\nC:H - Short tokens make gss_krb5_unwrap_v2() read EC/RRC past the token, and the dead BUG_ON lets unsigned movelen underflow into a ~UINT_MAX-byte memmove that copies kernel memory beyond the receive head; that unbounded read is C:H per kernel CNA memory-corruption guidance.\nI:H - The same underflowed memmove() writes near 4GiB through the RPC receive head, an out-of-bounds write exploitable for control-flow hijack. rotate_left() also ignores xdr_buf_subsegment() failure after u32 wrap and then writes through a subbuf whose length has wrapped.\nA:H - _rotate_left() does shift %= buf-\u003elen on a zero-length subbuffer (header-only token at the XDR boundary), a divide-by-zero oops/panic; the UINT_MAX memmove and wrapped-length rotate loop hang or oops nfsd/callback threads, and the attacker can repeat the RPC to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:53.633Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd6afc6cab8c5d387d1ed2f069562ef7bdadd651"
        },
        {
          "url": "https://git.kernel.org/stable/c/de942dd8c2c8358bcad04ce44271954c48924423"
        },
        {
          "url": "https://git.kernel.org/stable/c/2eed1e6a976a44015c3ee78841fe336796e2b21c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a919c5c88769cf8fb3ec071e6078d830bf512489"
        }
      ],
      "title": "SUNRPC: svcauth_gss: enforce krb5 token minimum length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89550",
    "datePublished": "2026-09-11T19:44:24.572Z",
    "dateReserved": "2026-09-11T19:38:34.723Z",
    "dateUpdated": "2026-09-14T12:00:53.633Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89550",
      "date": "2026-09-15",
      "epss": "0.00463",
      "percentile": "0.38945"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:52:40.000Z",
      "cve": "CVE-2026-89550",
      "id": "msrc_CVE-2026-89550",
      "initial_release_date": "2026-09-13T01:06:22.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "SUNRPC: svcauth_gss: enforce krb5 token minimum length",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89550.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89550\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:38.500\",\"lastModified\":\"2026-09-14T13:19:10.017\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: svcauth_gss: enforce krb5 token minimum length\\n\\nsvcauth_gss_unwrap_priv() validates only an upper bound on the\\nwire-supplied opaque length before handing the buffer to\\ngss_unwrap():\\n\\n    if (len \u003e xdr_stream_remaining(xdr))\\n            goto unwrap_failed;\\n    offset = xdr_stream_pos(xdr);\\n    ...\\n    maj_stat = gss_unwrap(ctx, offset, offset + len, buf);\\n\\nThe wire value `len` flows unchanged as the upper bound into the\\nkrb5 unwrap path, so a len in [0, 16] passes this check and is\\nhanded to gss_unwrap(). For a krb5 v2 context that lands in\\ngss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token\\nheader fields at ptr+4 and ptr+6 and then calls rotate_left()\\nbefore any integrity check. With a sub-header length the header\\nreads run past the token, and _rotate_left()\u0027s `shift %= buf-\u003elen`\\npath can divide by zero when buf-\u003elen has been driven to zero by\\nthe truncated token. A header-only token (len == 16) is equally\\ninvalid: with a non-zero RRC field and the opaque blob ending at\\nthe XDR buffer boundary, rotate_left() builds a zero-length\\nsubbuffer, reaching the same division.\\n\\nReject the token at the server entry point before it reaches the\\nkrb5 unwrap core. A valid sealed RFC 4121 token must contain\\nthe 16-byte header plus at least some encrypted payload.\\n\\nFix by adding a minimum-length check immediately after the\\nexisting upper-bound check:\\n\\n    if (len \u003c= GSS_KRB5_TOK_HDR_LEN)\\n            goto unwrap_failed;\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/auth_gss/svcauth_gss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c9fdcfb1b64c47ed618c103b617af3f86e1239c\",\"lessThan\":\"0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c9fdcfb1b64c47ed618c103b617af3f86e1239c\",\"lessThan\":\"dd6afc6cab8c5d387d1ed2f069562ef7bdadd651\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c9fdcfb1b64c47ed618c103b617af3f86e1239c\",\"lessThan\":\"de942dd8c2c8358bcad04ce44271954c48924423\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c9fdcfb1b64c47ed618c103b617af3f86e1239c\",\"lessThan\":\"2eed1e6a976a44015c3ee78841fe336796e2b21c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7c9fdcfb1b64c47ed618c103b617af3f86e1239c\",\"lessThan\":\"a919c5c88769cf8fb3ec071e6078d830bf512489\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/auth_gss/svcauth_gss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2eed1e6a976a44015c3ee78841fe336796e2b21c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a919c5c88769cf8fb3ec071e6078d830bf512489\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dd6afc6cab8c5d387d1ed2f069562ef7bdadd651\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/de942dd8c2c8358bcad04ce44271954c48924423\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:50:24+00:00",
      "cve": "CVE-2026-89550",
      "id": "CVE-2026-89550",
      "initial_release_date": "2026-09-11T19:44:24.572000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service in SUNRPC via crafted Kerberos token",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89550.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-09-13T16:58:42Z",
      "cve": "CVE-2026-89550",
      "id": "CVE-2026-89550",
      "initial_release_date": "2026-09-12T16:26:12Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89550",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89550.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.