GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89551 (GCVE-0-2026-89551)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:00
VLAI
Title
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp: fix_len: buf->len -= (len - trim); When the caller has set buf->len to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf->len and the unsigned subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches xdr_buf_trim() in exactly that state: buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip); xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); buf->len is a small wire-derived value while the iov_lens are at page scale, so the per-section loops legitimately consume far more bytes than buf->len records. The wrapped buf->len then propagates as the authoritative stream bound into every downstream XDR decoder. Fix by clamping the decrement so buf->len bottoms out at zero: buf->len -= min_t(unsigned int, buf->len, len - trim); On the normal path where the iov_lens sum to buf->len, (len - trim) is always <= buf->len and the result is identical to before. No callers change behavior outside the underflow case.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < a3d77bcd974b8625d16bddf448cb3a1b5e37049c (git)
Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < fa16bbe987b47e771e52eeb1b4540f18d92496ac (git)
Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < a924ac4c78afab71bf82641afa3b62e0c4a8b55e (git)
Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4 (git)
Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < e6267cccd7b05cc514e57f2160aa8db85f5c2701 (git)
Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < ad0cce80d4af2f74674e8b635d97aa3880e83da8 (git)
Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 85e9602650e9df07190abe817cee3b4d9bc3df17 (git)
Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 3f491306dcb673ff5e78e1044ba450c58978774e (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.9
Unaffected: 0 , < 3.9 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3d77bcd974b8625d16bddf448cb3a1b5e37049c",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "fa16bbe987b47e771e52eeb1b4540f18d92496ac",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "a924ac4c78afab71bf82641afa3b62e0c4a8b55e",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n    fix_len:\n            buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before.  No\ncallers change behavior outside the underflow case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - xdr_buf_trim() is reached from nfsd RPCSEC_GSS privacy unwrap on TCP/2049 (svcauth_gss_unwrap_priv \u2192 gss_unwrap \u2192 gss_krb5_unwrap_v2) and from the NFS client\u0027s gss_unwrap_resp_priv() on every krb5p reply, so a remote NFS peer delivers the wrap token over the network.\nAC:L - A peer holding the GSS session keys can encrypt a RFC 4121 wrap token so that after decrypt, buf-\u003elen is a small wire-derived value while iov_lens remain page-scale; xdr_buf_trim() then subtracts more than buf-\u003elen and wraps, with no race or layout outside attacker control.\nPR:N - A malicious or compromised NFS server that already shares a krb5p GSS context needs no account or capability on the victim client; ordinary krb5p replies and NFSv4.0 GSS callbacks are processed without local privileges on that host.\nUI:N - Once a krb5p NFS mount exists, the client unwraps every privacy-protected reply and NFSv4.0 GSS callback with no further mount, click, or open; idle revalidations and server-driven callbacks are sufficient.\nS:U - The wrapped buf-\u003elen and subsequent XDR decode run in the host kernel that processed the RPC and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed buf-\u003elen (~UINT_MAX) becomes the authoritative stream bound, and on nfsd xdr-\u003enwords also underflows via saved_len - buf-\u003elen, so later xdr_read_pages/xdr_shrink_bufhead and NFS XDR decoders read far past the receive buffer into adjacent kernel memory.\nI:H - xdr_shrink_bufhead() calls xdr_buf_head_shift_right() with a near-UINT_MAX length derived from the wrapped buf-\u003elen, and garbage xdr_stream_pos values can index the svc pages[] array out of bounds, an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Those unbounded XDR copies and the inconsistent xdr_buf (wrapped length versus iov_lens) oops or panic nfsd or the NFS client, and the peer can repeat the request at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:54.700Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
        },
        {
          "url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
        }
      ],
      "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89551",
    "datePublished": "2026-09-11T19:44:25.327Z",
    "dateReserved": "2026-09-11T19:38:34.723Z",
    "dateUpdated": "2026-09-14T12:00:54.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89551",
      "date": "2026-09-15",
      "epss": "0.00521",
      "percentile": "0.42766"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T15:01:10.000Z",
      "cve": "CVE-2026-89551",
      "id": "msrc_CVE-2026-89551",
      "initial_release_date": "2026-09-13T01:13:20.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89551.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89551\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:38.640\",\"lastModified\":\"2026-09-14T13:19:10.160\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\\n\\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\\nwalking the tail, pages, and head iovecs.  Each per-section step\\nuses min_t() so it never removes more bytes than that section\\nholds, but the final accounting at the fix_len label subtracts the\\ntotal bytes actually consumed from buf-\u003elen without any clamp:\\n\\n    fix_len:\\n            buf-\u003elen -= (len - trim);\\n\\nWhen the caller has set buf-\u003elen to a value smaller than the sum\\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\\nxdr_buf_trim() in exactly that state:\\n\\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\\n\\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\\npage scale, so the per-section loops legitimately consume far more\\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\\nas the authoritative stream bound into every downstream XDR\\ndecoder.\\n\\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\\n\\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\\n\\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\\nis always \u003c= buf-\u003elen and the result is identical to before.  No\\ncallers change behavior outside the underflow case.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"a3d77bcd974b8625d16bddf448cb3a1b5e37049c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"fa16bbe987b47e771e52eeb1b4540f18d92496ac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"a924ac4c78afab71bf82641afa3b62e0c4a8b55e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"e6267cccd7b05cc514e57f2160aa8db85f5c2701\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"ad0cce80d4af2f74674e8b635d97aa3880e83da8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"85e9602650e9df07190abe817cee3b4d9bc3df17\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"3f491306dcb673ff5e78e1044ba450c58978774e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:50:26+00:00",
      "cve": "CVE-2026-89551",
      "id": "CVE-2026-89551",
      "initial_release_date": "2026-09-11T19:44:25.327000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: SUNRPC xdr_buf_trim integer underflow leads to data corruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89551.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.