Linux kernel SUNRPC auth_gss: gss_auth reference leaked when gss_alloc_msg allocation fails

CVSS 5.5CVE-2026-45964Kernel, userspace & hypervisorcurated

Impact

gss_alloc_msg() takes a kref on gss_auth to balance the put done in gss_release_msg(), but the error path after a failed kstrdup_const() of the service name frees the message without dropping that reference. Each occurrence pins a gss_auth structure forever, so the credential cache for a Kerberized RPC mount never shrinks. On storage-heavy GPU nodes using sec=krb5 NFS this is slow unreclaimable kernel memory growth under memory pressure, ending in a reboot to recover. Distinct from the XDR decode leaks in CVE-2026-45870 - different function, different commit series.

Who can reach it

Local and indirect: the error path requires an allocation failure while setting up a GSS upcall message, so it is reached under memory pressure on a host doing Kerberos RPC, not by a directed attacker action the record describes.

What to do

Update to a stable kernel carrying the kref_put() in the err_put_pipe_version path (five stable commits linked) and reboot the node. No runtime mitigation; leaked gss_auth structures are only released by a reboot.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-45964 https://git.kernel.org/stable/c/3b2b6c42070ce4204936288253baf101e995c2d3 https://git.kernel.org/stable/c/a1bc9561b617ec7e2d09e6c134d1db8fcf9ca4a6 https://git.kernel.org/stable/c/b559be2ec6cdb2e9c2c36c23fbbd4690d8a5c3f7

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.