GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89542 (GCVE-0-2026-89542)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:00
VLAI
Title
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN (16) bytes long, and its rotate_left() helper passes buf->len - base to xdr_buf_subsegment() without verifying that base <= buf->len. When a caller hands in a sub-16-byte token, or a token whose declared len leaves base past the end of the buffer, three distinct failures follow: gss_krb5_unwrap_v2(offset, len, buf) ptr = buf->head[0].iov_base + offset ec = *(ptr + 4) /* OOB read on short head */ rrc = *(ptr + 6) /* OOB read on short head */ rotate_left(offset + 16, buf, rrc) xdr_buf_subsegment(buf, &subbuf, base, buf->len - base) /* u32 wrap when base > len */ _rotate_left(&subbuf, shift) shift %= buf->len /* divide-by-zero when base == len */ After decryption, the cleanup arithmetic has the same shape: movelen = min_t(unsigned int, buf->head[0].iov_len, len); movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip; BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > buf->head[0].iov_len); The BUG_ON re-adds the value just subtracted, so it reduces to min(A, B) > A and is permanently false; it cannot catch the unsigned underflow of movelen, which then drives a ~UINT_MAX-byte memmove(). Add four defense-in-depth guards inside the unwrap core so it is safe regardless of what its callers validate: - reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before touching ptr+4/ptr+6; - bail from rotate_left() when buf->len <= base, covering both the underflow and zero-length cases; - return early from _rotate_left() when buf->len is zero, so the shift %= buf->len modulo cannot fault; - replace the dead BUG_ON with a live check that returns GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: de9c17eb4a912c9028f7b470eb80815144883b26 , < 299d281c7225ded15b28cb861a98d818d82787fc (git)
Affected: de9c17eb4a912c9028f7b470eb80815144883b26 , < 84ddbc8d084c0251d534f14f5d1a7da05be56404 (git)
Affected: de9c17eb4a912c9028f7b470eb80815144883b26 , < 075d7cfc4df8c54cb202ba8b28420370c03ba9b6 (git)
Affected: de9c17eb4a912c9028f7b470eb80815144883b26 , < f2591660e0eb263c9415bf0d0bb1b111e62df7a4 (git)
Affected: de9c17eb4a912c9028f7b470eb80815144883b26 , < dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087 (git)
Affected: de9c17eb4a912c9028f7b470eb80815144883b26 , < 806584a4b67a7233870c33e5b8f872e76dd02988 (git)
Affected: de9c17eb4a912c9028f7b470eb80815144883b26 , < a7894e10572d53eb10109b8d07459cc8d3435811 (git)
Affected: de9c17eb4a912c9028f7b470eb80815144883b26 , < 6959297aaa9572783d620a226d73c3fb94494888 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.35
Unaffected: 0 , < 2.6.35 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_krb5_wrap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "299d281c7225ded15b28cb861a98d818d82787fc",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "84ddbc8d084c0251d534f14f5d1a7da05be56404",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "075d7cfc4df8c54cb202ba8b28420370c03ba9b6",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "f2591660e0eb263c9415bf0d0bb1b111e62df7a4",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "806584a4b67a7233870c33e5b8f872e76dd02988",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "a7894e10572d53eb10109b8d07459cc8d3435811",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "6959297aaa9572783d620a226d73c3fb94494888",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_krb5_wrap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_krb5_unwrap_v2 against short tokens\n\ngss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and\nptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN\n(16) bytes long, and its rotate_left() helper passes buf-\u003elen - base\nto xdr_buf_subsegment() without verifying that base \u003c= buf-\u003elen. When\na caller hands in a sub-16-byte token, or a token whose declared len\nleaves base past the end of the buffer, three distinct failures follow:\n\n    gss_krb5_unwrap_v2(offset, len, buf)\n      ptr = buf-\u003ehead[0].iov_base + offset\n      ec  = *(ptr + 4)              /* OOB read on short head */\n      rrc = *(ptr + 6)              /* OOB read on short head */\n      rotate_left(offset + 16, buf, rrc)\n        xdr_buf_subsegment(buf, \u0026subbuf,\n                           base, buf-\u003elen - base)   /* u32 wrap when base \u003e len */\n        _rotate_left(\u0026subbuf, shift)\n          shift %= buf-\u003elen         /* divide-by-zero when base == len */\n\nAfter decryption, the cleanup arithmetic has the same shape:\n\n    movelen = min_t(unsigned int, buf-\u003ehead[0].iov_len, len);\n    movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;\n    BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen \u003e\n                                            buf-\u003ehead[0].iov_len);\n\nThe BUG_ON re-adds the value just subtracted, so it reduces to\nmin(A, B) \u003e A and is permanently false; it cannot catch the unsigned\nunderflow of movelen, which then drives a ~UINT_MAX-byte memmove().\n\nAdd four defense-in-depth guards inside the unwrap core so it is safe\nregardless of what its callers validate:\n\n  - reject tokens with len - offset \u003c GSS_KRB5_TOK_HDR_LEN before\n    touching ptr+4/ptr+6;\n  - bail from rotate_left() when buf-\u003elen \u003c= base, covering both the\n    underflow and zero-length cases;\n  - return early from _rotate_left() when buf-\u003elen is zero, so the\n    shift %= buf-\u003elen modulo cannot fault;\n  - replace the dead BUG_ON with a live check that returns\n    GSS_S_DEFECTIVE_TOKEN before the movelen subtraction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - gss_krb5_unwrap_v2() is reached from nfsd RPCSEC_GSS privacy unwrap (svcauth_gss_accept \u2192 svcauth_gss_unwrap_priv \u2192 gss_unwrap) on TCP/2049 and from the NFS client gss_unwrap_resp_priv() path on a krb5p Reply, so a remote RPCSEC_GSS peer delivers the crafted wrap token over the network.\nAC:L - A single crafted RPCSEC_GSS DATA/Reply with a sub-16-byte wrap token (KG2_TOK_WRAP, sealed flags, non-zero RRC) deterministically hits the pre-decrypt ptr+4/ptr+6 reads, rotate_left() u32 wrap, and shift%=0 divide-by-zero; no race or attacker-uncontrollable layout is required.\nPR:N - A malicious NFS server on an existing krb5p session needs no account or capability on the victim client to send the crafted Reply into gss_unwrap_resp_priv(). That client-victim path is the highest-severity reachability and requires no privileges on the target.\nUI:N - nfsd unwraps the Call in the service thread with no local user action. On the client, gss_unwrap_resp_priv() runs automatically from the RPC receive path once an NFS/RPCSEC_GSS mount exists; no additional mount, click, or open is required at attack time.\nS:U - The out-of-bounds accesses, divide-by-zero, and underflowed memmove corrupt host kernel SUNRPC/GSS state on the machine processing the RPC. This is ordinary same-host kernel impact, not a VM escape, IOMMU bypass, or other changed-scope boundary.\nC:H - Short tokens make gss_krb5_unwrap_v2() read EC/RRC past the token, and the dead BUG_ON lets unsigned movelen underflow into a ~UINT_MAX-byte memmove() that copies kernel memory beyond the receive head; that unbounded read is C:H per kernel CNA memory-corruption guidance.\nI:H - The same underflowed memmove() writes near 4GiB through the RPC receive head, an out-of-bounds write exploitable for control-flow hijack. rotate_left() also ignores xdr_buf_subsegment() failure after u32 wrap and then writes through a subbuf whose length has wrapped.\nA:H - _rotate_left() does shift %= buf-\u003elen on a zero-length subbuffer (header-only token at the XDR boundary), a divide-by-zero oops/panic; the UINT_MAX memmove and wrapped-length rotate loop hang or oops nfsd/rpciod, and the attacker can repeat the RPC to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:49.355Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404"
        },
        {
          "url": "https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087"
        },
        {
          "url": "https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811"
        },
        {
          "url": "https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888"
        }
      ],
      "title": "SUNRPC: harden gss_krb5_unwrap_v2 against short tokens",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89542",
    "datePublished": "2026-09-11T19:44:18.931Z",
    "dateReserved": "2026-09-11T19:38:34.722Z",
    "dateUpdated": "2026-09-14T12:00:49.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89542",
      "date": "2026-09-17",
      "epss": "0.00521",
      "percentile": "0.43031"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:54:48.000Z",
      "cve": "CVE-2026-89542",
      "id": "msrc_CVE-2026-89542",
      "initial_release_date": "2026-09-13T01:08:09.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "SUNRPC: harden gss_krb5_unwrap_v2 against short tokens",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89542.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89542\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:37.380\",\"lastModified\":\"2026-09-14T13:19:09.370\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: harden gss_krb5_unwrap_v2 against short tokens\\n\\ngss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and\\nptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN\\n(16) bytes long, and its rotate_left() helper passes buf-\u003elen - base\\nto xdr_buf_subsegment() without verifying that base \u003c= buf-\u003elen. When\\na caller hands in a sub-16-byte token, or a token whose declared len\\nleaves base past the end of the buffer, three distinct failures follow:\\n\\n    gss_krb5_unwrap_v2(offset, len, buf)\\n      ptr = buf-\u003ehead[0].iov_base + offset\\n      ec  = *(ptr + 4)              /* OOB read on short head */\\n      rrc = *(ptr + 6)              /* OOB read on short head */\\n      rotate_left(offset + 16, buf, rrc)\\n        xdr_buf_subsegment(buf, \u0026subbuf,\\n                           base, buf-\u003elen - base)   /* u32 wrap when base \u003e len */\\n        _rotate_left(\u0026subbuf, shift)\\n          shift %= buf-\u003elen         /* divide-by-zero when base == len */\\n\\nAfter decryption, the cleanup arithmetic has the same shape:\\n\\n    movelen = min_t(unsigned int, buf-\u003ehead[0].iov_len, len);\\n    movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;\\n    BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen \u003e\\n                                            buf-\u003ehead[0].iov_len);\\n\\nThe BUG_ON re-adds the value just subtracted, so it reduces to\\nmin(A, B) \u003e A and is permanently false; it cannot catch the unsigned\\nunderflow of movelen, which then drives a ~UINT_MAX-byte memmove().\\n\\nAdd four defense-in-depth guards inside the unwrap core so it is safe\\nregardless of what its callers validate:\\n\\n  - reject tokens with len - offset \u003c GSS_KRB5_TOK_HDR_LEN before\\n    touching ptr+4/ptr+6;\\n  - bail from rotate_left() when buf-\u003elen \u003c= base, covering both the\\n    underflow and zero-length cases;\\n  - return early from _rotate_left() when buf-\u003elen is zero, so the\\n    shift %= buf-\u003elen modulo cannot fault;\\n  - replace the dead BUG_ON with a live check that returns\\n    GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/auth_gss/gss_krb5_wrap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"de9c17eb4a912c9028f7b470eb80815144883b26\",\"lessThan\":\"299d281c7225ded15b28cb861a98d818d82787fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de9c17eb4a912c9028f7b470eb80815144883b26\",\"lessThan\":\"84ddbc8d084c0251d534f14f5d1a7da05be56404\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de9c17eb4a912c9028f7b470eb80815144883b26\",\"lessThan\":\"075d7cfc4df8c54cb202ba8b28420370c03ba9b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de9c17eb4a912c9028f7b470eb80815144883b26\",\"lessThan\":\"f2591660e0eb263c9415bf0d0bb1b111e62df7a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de9c17eb4a912c9028f7b470eb80815144883b26\",\"lessThan\":\"dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de9c17eb4a912c9028f7b470eb80815144883b26\",\"lessThan\":\"806584a4b67a7233870c33e5b8f872e76dd02988\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de9c17eb4a912c9028f7b470eb80815144883b26\",\"lessThan\":\"a7894e10572d53eb10109b8d07459cc8d3435811\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de9c17eb4a912c9028f7b470eb80815144883b26\",\"lessThan\":\"6959297aaa9572783d620a226d73c3fb94494888\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/auth_gss/gss_krb5_wrap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.35\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.35\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:50:13+00:00",
      "cve": "CVE-2026-89542",
      "id": "CVE-2026-89542",
      "initial_release_date": "2026-09-11T19:44:18.931000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: SUNRPC memory corruption via crafted tokens",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89542.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:02:13Z",
      "cve": "CVE-2026-89542",
      "id": "CVE-2026-89542",
      "initial_release_date": "2026-09-12T16:26:22Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89542",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89542.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.