Linux kernel SUNRPC: short krb5 wrap tokens cause OOB reads, a divide-by-zero and a huge memmove

Impact

gss_krb5_unwrap_v2() read the EC and RRC fields before checking that the token is at least 16 bytes, rotate_left() passed an underflowing length to xdr_buf_subsegment(), _rotate_left() could take a modulo by zero, and the post-decrypt BUG_ON was tautologically false so an unsigned underflow of movelen could drive a memmove of roughly UINT_MAX bytes. Any of these on a krb5 NFS mount is a host-kernel crash or memory corruption on a node that is carrying jobs. The fix adds four independent guards inside the unwrap core so it is safe whatever its callers validate - which is the right reading of how exposed this path was.

Who can reach it

A krb5 NFS peer whose tokens reach the unwrap path - in practice the fileserver the node mounts, or anyone who can answer for it. No separate authentication step beyond the existing mount.

What to do

Install a stable kernel with the four guards (commits in the record). No configuration workaround beyond restricting krb5 mounts to trusted servers. Rollout is a kernel upgrade, so drain and reboot each node.

References

Related entries

• Linux kernel SUNRPC: stale pipefs_sb pointer leaves dentries referencing a freed rpc_clntCVE-2026-89543 · Linux kernel SUNRPC (rpc_clnt pipefs superblock tracking)Unscored
• Linux kernel SUNRPC: nfsd request buffers freed before the RCU grace period, causing a use-after-freeCVE-2026-89545 · Linux kernel SUNRPC server (svc_rqst_free, rq_argp/rq_resp RCU lifetime)Unscored
• Linux kernel NFS: backchannel request racing callback shutdown leaks transport refs or queues onto a freed svc_servCVE-2026-89546 · Linux kernel SUNRPC/NFS backchannel (xprt_enqueue_bc_request, callback service teardown)Unscored
• Linux kernel SUNRPC: use-after-free when a network namespace tears down an RPC cacheCVE-2026-89548 · Linux kernel SUNRPC (per-netns cache_detail teardown)Unscored
• Linux kernel nfsd: undersized Kerberos token reaches the krb5 unwrap core and divides by zeroCVE-2026-89550 · Linux kernel SUNRPC svcauth_gss (krb5 token length validation)Unscored
• Linux kernel SUNRPC: xdr_buf_trim underflows buf->len, handing XDR decoders a near-UINT_MAX boundCVE-2026-89551 · Linux kernel SUNRPC xdr_buf_trim (buf->len underflow)Unscored