Linux kernel SUNRPC: short Kerberos MIC tokens read past a slab allocation on the RPC client and server

Impact

gss_krb5_verify_mic_v2() read the token header and checksum without first checking the wire-supplied length, and every caller accepted short tokens. A malicious or compromised NFS server can return a truncated checksum blob that the client kmallocs and then reads past, and the server-side header and integrity paths accept tokens as short as four bytes. That is an out-of-bounds slab read in the host kernel, reachable from the network on any node using krb5 NFS. On a GPU node this is a host-kernel memory disclosure or crash primitive triggered by whatever fileserver the training job mounts, and recovering it costs a reboot.

Who can reach it

An NFS server the node mounts, or anyone who can impersonate it on the storage network, with no client-side authentication needed beyond the existing mount. On the server side, an RPC peer that can reach the krb5-authenticated nfsd.

What to do

Update to a stable kernel containing the length guard in gss_krb5_verify_mic_v2() (commits in the record). No configuration mitigation other than not using krb5 flavours on untrusted storage networks. Rolling the kernel means draining and rebooting each node.

References

Related entries

• Linux kernel SUNRPC: oversized krb5 wrap-token ec field leaves the receive xdr_buf in an inconsistent stateCVE-2026-89538 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2, extra-count field)Unscored
• Linux kernel SUNRPC: integer overflow in krb5p reply length check lets a hostile NFS server drive OOB readsCVE-2026-89541 · Linux kernel SUNRPC (gss_unwrap_resp_priv RPCSEC_GSS opaque length check)Unscored
• Linux kernel SUNRPC: short krb5 wrap tokens cause OOB reads, a divide-by-zero and a huge memmoveCVE-2026-89542 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2 and rotate_left short-token handling)Unscored
• Linux kernel SUNRPC: stale pipefs_sb pointer leaves dentries referencing a freed rpc_clntCVE-2026-89543 · Linux kernel SUNRPC (rpc_clnt pipefs superblock tracking)Unscored
• Linux kernel SUNRPC: nfsd request buffers freed before the RCU grace period, causing a use-after-freeCVE-2026-89545 · Linux kernel SUNRPC server (svc_rqst_free, rq_argp/rq_resp RCU lifetime)Unscored
• Linux kernel NFS: backchannel request racing callback shutdown leaks transport refs or queues onto a freed svc_servCVE-2026-89546 · Linux kernel SUNRPC/NFS backchannel (xprt_enqueue_bc_request, callback service teardown)Unscored