Linux kernel SUNRPC: gssx decode error paths NULL-deref and leak group_info on the NFS server

Impact

On an NFS server using Kerberos via gss-proxy, a failed allocation or a malformed gssx response leaves the decoded option array with count=1 and a NULL data pointer, and the caller dereferences data[0].value - a kernel oops that takes the file server down. The same error paths free a partially decoded svc_cred with a bare kfree, leaking the refcounted, kvmalloc-backed group_info on every failure. For a GPU fleet this matters where krb5 NFS backs home directories, datasets or checkpoints: the crash is on the server, so every node mounting it stalls at once, and recovery is a reboot of a machine that many jobs depend on.

Who can reach it

Reachable through the gss-proxy upcall path on an NFS server running krb5 security flavours; an unauthenticated client can drive context establishment, but the record does not show a clean remote trigger - the documented failure is an allocation failure or a bad gssx reply.

What to do

Update the host kernel to a stable release containing the fix (three stable branches carry it; see the git.kernel.org commits) and reboot the NFS server. No live mitigation is described beyond not running krb5 NFS; the fix is kernel-side only, so the server must be drained and rebooted.

References

Related entries

• Linux kernel nfsd: transports routed to threadless service pools hang the connection indefinitelyCVE-2026-89549 · Linux kernel SUNRPC svc_pool_for_cpu() (nfsd pool-to-CPU routing)High
• Linux kernel nfsd: broken short-write detection writes the next segment at the wrong file offsetCVE-2026-89678 · Linux kernel nfsd_direct_write() (NFS server direct-I/O write path)High
• Linux kernel nfsd: NFSv4 SETATTR with the special ONE stateid NULL-derefs and oopses the serverCVE-2026-89679 · Linux kernel nfsd4_setattr() (NFSv4 delegated timestamp attributes)High
• Linux kernel nfsd: each failed inter-server COPY leaks an nfsd_file, pinning inode and mountCVE-2026-89680 · Linux kernel nfsd4_copy() (inter-server COPY setup error path)High
• Linux kernel nfsd: race between cpntf publish and OFFLOAD_CANCEL oopses on an uninitialised list headCVE-2026-89684 · Linux kernel nfsd nfs4_alloc_init_cpntf_state() (server-to-server copy stateid IDR)High
• Linux kernel nfsd: clock-domain mismatch lets one client hold the server in grace indefinitelyCVE-2026-89685 · Linux kernel nfsd clients_still_reclaiming() (grace period deadline)High