Linux kernel SUNRPC: xdr_buf_trim underflows buf->len, handing XDR decoders a near-UINT_MAX bound

Impact

xdr_buf_trim() subtracted the bytes it consumed from buf->len with no clamp. gss_krb5_unwrap_v2() calls it in exactly the state where that breaks: buf->len is a small wire-derived value while the iovec lengths are at page scale, so the subtraction wraps to near UINT_MAX. The wrapped length then propagates as the authoritative stream bound into every downstream XDR decoder, meaning the decoders believe they may read far past the real data. This sits on the same kerberised NFS receive path as the token-length bug in this batch but is a distinct defect with its own fix, and it converts a decode of attacker-supplied bytes into an out-of-bounds read across kernel memory.

Who can reach it

Remote, from a host able to send GSS-wrapped RPC to a kernel NFS server (or to reach a client's RPC reply path). The underflow happens during unwrap, before the decoded content is trusted.

What to do

Apply the stable kernel update that clamps the decrement (buf->len -= min_t(unsigned int, buf->len, len - trim)), then drain and reboot each affected node. Normal-path behaviour is unchanged by the fix, so it is a low-regression-risk backport. No runtime mitigation other than restricting who can send RPC to the server. The record names commits, not fixed releases.

References

Related entries

• Linux kernel CXL: MCE notifier outlives its memory device, giving NULL deref and use-after-freeCVE-2026-89570 · Linux kernel CXL MCE notifier (per-memdev registration lifetime)Unscored
• Linux kernel CXL fwctl: unchecked op_size reads past the input buffer and into the device mailboxCVE-2026-89571 · Linux kernel CXL features fwctl (cxlctl_fw_rpc op_size validation)Unscored
• Linux kernel BPF: preemptible bpf_get_stack reuses a per-CPU callchain buffer and writes out of boundsCVE-2026-89580 · Linux kernel BPF __bpf_get_stack (per-CPU callchain entry reuse)Unscored
• Linux kernel BPF x86 JIT: per-CPU address lands in the wrong register, clobbering RAX or the frame pointerCVE-2026-89581 · Linux kernel BPF x86-64 JIT (per-CPU address MOV register encoding)Unscored
• Linux kernel GHES: CXL CPER work locks taken without IRQ protection can deadlock a CPUCVE-2026-89589 · Linux kernel ACPI APEI GHES (CXL CPER work locks)Unscored
• Linux kernel hugetlb: reservation counter underflow when a parent unmaps a shared huge page firstCVE-2026-89593 · Linux kernel hugetlb (__unmap_hugepage_range reservation accounting)Unscored