OpenSSH: heap out-of-bounds read during GSSAPI indicator cleanup crashes the authentication path

Impact

A missing NULL terminator in the auth-indicators array leads to a heap out-of-bounds read while sshd cleans up GSSAPI indicators, aborting the authentication process. On hosts configured for GSSAPI/Kerberos authentication this is a remote availability hit on the one service operators use to reach a node - losing sshd on a GPU node means losing the path used to drain jobs, collect logs, and reset the box, which then costs an out-of-band or BMC-console trip. Only the per-connection authentication path is affected, so it is a denial of service rather than a route to code execution. Hosts that do not enable GSSAPIAuthentication in a Kerberos realm are not exposed.

Who can reach it

A remote, unauthenticated attacker who can open a TCP connection to sshd, but only on hosts where GSSAPIAuthentication is enabled and a Kerberos environment is configured. Exploitation conditions are described as specific to that configuration.

What to do

Apply the vendor OpenSSH update (Red Hat shipped RHSA-2026:36759, RHSA-2026:47756, RHSA-2026:47757 and RHSA-2026:54387 for the affected RHEL streams and Hardened Images) and restart sshd; existing sessions survive the restart. As an interim mitigation on nodes that do not need it, set GSSAPIAuthentication no and reload sshd.

References