Linux kernel SUNRPC auth_gss: kernel memory leaks on GSS-proxy XDR decode error paths

Impact

The gssx_* decoders allocate buffers with kmemdup() and return early when a later field fails to decode, leaking every buffer allocated before the failure. gssp_accept_sec_context_upcall() pre-sizes four such buffers (context token, mech OID, and both principal names), so a single failed context acceptance can leak several hundred bytes that are never reclaimed. On a node that mounts Kerberized NFS - common for HPC and shared-dataset GPU clusters - repeated malformed or failing GSS context negotiations grow unreclaimable kernel memory until the node needs a reboot. No disclosure or privilege escalation is described in the record.

Who can reach it

Reached through the gssproxy upcall path on a host using Kerberos RPC (NFS sec=krb5*). The trigger is a decode failure during context acceptance, so it needs something that can drive repeated failing GSS negotiations against the node's RPC service; the record does not establish an unauthenticated remote path.

What to do

Move to a stable kernel with the goto-based cleanup (five stable commits linked) and reboot affected nodes. Interim mitigation is limited to not using Kerberos RPC security flavors on exposed mounts; the leak cannot be reclaimed without a reboot.

References

Related entries

• Linux kernel (drivers/pci): A failed mmap of peer-to-peer DMA memory leaks the pgmap reference it took, and the leak isCVE-2026-45880 · Linux kernel (drivers/pci)Medium
• Linux kernel BPF: wrong bpf_xdp_store_bytes argument type lets the helper read uninitialized memoryCVE-2026-45886 · Linux kernel BPF (bpf_xdp_store_bytes helper argument type)Medium
• Linux kernel RT scheduler: self-IPI storm in rto_next_cpu() can hard-lock a CPUCVE-2026-45919 · Linux kernel sched/rt (rto_next_cpu() RT push-IPI loop)Medium
• Linux kernel SUNRPC auth_gss: gss_auth reference leaked when gss_alloc_msg allocation failsCVE-2026-45964 · Linux kernel SUNRPC auth_gss (gss_alloc_msg kref leak on kstrdup_const failure)Medium
• Linux kernel KVM nSVM: interrupt shadow not synced to cached vmcb12, nested vCPU can hangCVE-2026-45987 · Linux kernel KVM nSVM (vmcb12 interrupt shadow sync)Medium
• Linux kernel KVM: DEBUGCTL and LBR MSRs missing from save/restore, guest branch state lostCVE-2026-46014 · Linux kernel KVM SVM/VMX (DEBUGCTL and LBR MSR save/restore)Medium