Linux kernel SUNRPC: integer overflow in krb5p reply length check lets a hostile NFS server drive OOB reads

Impact

The bound check on the RPCSEC_GSS opaque length was computed in u32, so a reply declaring a length near 0xffffffff wraps to a small value and passes, and there was no lower bound at all. gss_unwrap() is then called with end below begin, or with a token shorter than the 16-byte krb5 header, driving out-of-bounds reads in gss_krb5_unwrap_v2() and the rotate_left() loop that follows. This is the strongest of the batch: a crafted reply from the fileserver a GPU node mounts reaches host-kernel memory corruption or a panic, taking down whatever training or inference work is resident on that node.

Who can reach it

A krb5p NFS server the node mounts, or anyone able to answer as it on the storage network. The client accepts the malformed reply as part of normal traffic - no extra authentication step is needed beyond the mount already existing.

What to do

Update to a stable kernel carrying the three replacement guards in gss_unwrap_resp_priv() (commits in the record). Until then the only mitigation is to keep krb5p mounts pointed at trusted servers on a trusted network. The kernel update requires draining and rebooting every affected node.

References

Related entries

• Linux kernel SUNRPC: short krb5 wrap tokens cause OOB reads, a divide-by-zero and a huge memmoveCVE-2026-89542 · Linux kernel SUNRPC GSS-Kerberos (gss_krb5_unwrap_v2 and rotate_left short-token handling)Unscored
• Linux kernel SUNRPC: stale pipefs_sb pointer leaves dentries referencing a freed rpc_clntCVE-2026-89543 · Linux kernel SUNRPC (rpc_clnt pipefs superblock tracking)Unscored
• Linux kernel SUNRPC: nfsd request buffers freed before the RCU grace period, causing a use-after-freeCVE-2026-89545 · Linux kernel SUNRPC server (svc_rqst_free, rq_argp/rq_resp RCU lifetime)Unscored
• Linux kernel NFS: backchannel request racing callback shutdown leaks transport refs or queues onto a freed svc_servCVE-2026-89546 · Linux kernel SUNRPC/NFS backchannel (xprt_enqueue_bc_request, callback service teardown)Unscored
• Linux kernel SUNRPC: use-after-free when a network namespace tears down an RPC cacheCVE-2026-89548 · Linux kernel SUNRPC (per-netns cache_detail teardown)Unscored
• Linux kernel nfsd: undersized Kerberos token reaches the krb5 unwrap core and divides by zeroCVE-2026-89550 · Linux kernel SUNRPC svcauth_gss (krb5 token length validation)Unscored