Database/Kernel, userspace & hypervisor
Linux kernel SUNRPC: oversized krb5 wrap-token ec field leaves the receive xdr_buf in an inconsistent state
Impact
The 16-bit extra-count field of a krb5 v2 wrap token is authenticated, but any peer holding a valid GSS context can legitimately encrypt a token whose ec exceeds the plaintext length. That drives xdr_buf_trim() with a trim length larger than the data, leaving a zero-length buffer with inconsistent iov lengths for callers to work on. The practical effect is corrupted RPC receive state on a krb5p NFS mount rather than a clean error, on the host kernel of a node that is probably running jobs. Exposure needs an authenticated peer, which limits it to a compromised or hostile fileserver rather than an anonymous attacker.
Who can reach it
A peer that already holds a valid GSS context with the node - in practice a compromised or malicious krb5p NFS server or client. No unauthenticated path.
What to do
Install a stable kernel with the pre-trim ec validation (commits in the record). No runtime toggle; the fix ships only in the kernel, so each node needs a drain and reboot.
References
Related entries
- Linux kernel SUNRPC: integer overflow in krb5p reply length check lets a hostile NFS server drive OOB readsCVE-2026-89541 · Linux kernel SUNRPC (gss_unwrap_resp_priv RPCSEC_GSS opaque length check)Unscored
- Linux kernel SUNRPC: short krb5 wrap tokens cause OOB reads, a divide-by-zero and a huge memmoveCVE-2026-89542 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2 and rotate_left short-token handling)Unscored
- Linux kernel SUNRPC: stale pipefs_sb pointer leaves dentries referencing a freed rpc_clntCVE-2026-89543 · Linux kernel SUNRPC (rpc_clnt pipefs superblock tracking)Unscored
- Linux kernel SUNRPC: nfsd request buffers freed before the RCU grace period, causing a use-after-freeCVE-2026-89545 · Linux kernel SUNRPC server (svc_rqst_free, rq_argp/rq_resp RCU lifetime)Unscored
- Linux kernel NFS: backchannel request racing callback shutdown leaks transport refs or queues onto a freed svc_servCVE-2026-89546 · Linux kernel SUNRPC/NFS backchannel (xprt_enqueue_bc_request, callback service teardown)Unscored
- Linux kernel SUNRPC: use-after-free when a network namespace tears down an RPC cacheCVE-2026-89548 · Linux kernel SUNRPC (per-netns cache_detail teardown)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.