Vulnerability-Lookup

CVE-2026-89551 (GCVE-0-2026-89551)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:30

Title

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Summary

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp: fix_len: buf->len -= (len - trim); When the caller has set buf->len to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf->len and the unsigned subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches xdr_buf_trim() in exactly that state: buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip); xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); buf->len is a small wire-derived value while the iov_lens are at page scale, so the per-section loops legitimately consume far more bytes than buf->len records. The wrapped buf->len then propagates as the authoritative stream bound into every downstream XDR decoder. Fix by clamping the decrement so buf->len bottoms out at zero: buf->len -= min_t(unsigned int, buf->len, len - trim); On the normal path where the iov_lens sum to buf->len, (len - trim) is always <= buf->len and the result is identical to before. No callers change behavior outside the underflow case.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/e6267cccd7b05cc51…
https://git.kernel.org/stable/c/ad0cce80d4af2f746…
https://git.kernel.org/stable/c/85e9602650e9df071…
https://git.kernel.org/stable/c/3f491306dcb673ff5…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < e6267cccd7b05cc514e57f2160aa8db85f5c2701 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < ad0cce80d4af2f74674e8b635d97aa3880e83da8 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 85e9602650e9df07190abe817cee3b4d9bc3df17 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 3f491306dcb673ff5e78e1044ba450c58978774e (git)	guessed
Linux	Linux	Affected: 3.9 Unaffected: 0 , < 3.9 (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n    fix_len:\n            buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before.  No\ncallers change behavior outside the underflow case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - xdr_buf_trim() is reached from nfsd RPCSEC_GSS privacy unwrap on TCP/2049 (svcauth_gss_unwrap_priv \u2192 gss_unwrap \u2192 gss_krb5_unwrap_v2) and from the NFS client\u0027s gss_unwrap_resp_priv() on every krb5p reply, so a remote NFS peer delivers the wrap token over the network.\nAC:L - A peer holding the GSS session keys can encrypt a RFC 4121 wrap token so that after decrypt, buf-\u003elen is a small wire-derived value while iov_lens remain page-scale; xdr_buf_trim() then subtracts more than buf-\u003elen and wraps, with no race or layout outside attacker control.\nPR:N - A malicious or compromised NFS server that already shares a krb5p GSS context needs no account or capability on the victim client; ordinary krb5p replies and NFSv4.0 GSS callbacks are processed without local privileges on that host.\nUI:N - Once a krb5p NFS mount exists, the client unwraps every privacy-protected reply and NFSv4.0 GSS callback with no further mount, click, or open; idle revalidations and server-driven callbacks are sufficient.\nS:U - The wrapped buf-\u003elen and subsequent XDR decode run in the host kernel that processed the RPC and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed buf-\u003elen (~UINT_MAX) becomes the authoritative stream bound, and on nfsd xdr-\u003enwords also underflows via saved_len - buf-\u003elen, so later xdr_read_pages/xdr_shrink_bufhead and NFS XDR decoders read far past the receive buffer into adjacent kernel memory.\nI:H - xdr_shrink_bufhead() calls xdr_buf_head_shift_right() with a near-UINT_MAX length derived from the wrapped buf-\u003elen, and garbage xdr_stream_pos values can index the svc pages[] array out of bounds, an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Those unbounded XDR copies and the inconsistent xdr_buf (wrapped length versus iov_lens) oops or panic nfsd or the NFS client, and the peer can repeat the request at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:51.667Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
        },
        {
          "url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
        }
      ],
      "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89551",
    "datePublished": "2026-09-11T19:44:25.327Z",
    "dateReserved": "2026-09-11T19:38:34.723Z",
    "dateUpdated": "2026-09-13T06:30:51.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89551",
      "date": "2026-09-12",
      "epss": "0.00168",
      "percentile": "0.06327"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-13T01:13:20.000Z",
      "cve": "CVE-2026-89551",
      "id": "msrc_CVE-2026-89551",
      "initial_release_date": "2026-09-13T01:13:20.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89551.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89551\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:38.640\",\"lastModified\":\"2026-09-13T07:17:19.537\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\\n\\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\\nwalking the tail, pages, and head iovecs.  Each per-section step\\nuses min_t() so it never removes more bytes than that section\\nholds, but the final accounting at the fix_len label subtracts the\\ntotal bytes actually consumed from buf-\u003elen without any clamp:\\n\\n    fix_len:\\n            buf-\u003elen -= (len - trim);\\n\\nWhen the caller has set buf-\u003elen to a value smaller than the sum\\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\\nxdr_buf_trim() in exactly that state:\\n\\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\\n\\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\\npage scale, so the per-section loops legitimately consume far more\\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\\nas the authoritative stream bound into every downstream XDR\\ndecoder.\\n\\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\\n\\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\\n\\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\\nis always \u003c= buf-\u003elen and the result is identical to before.  No\\ncallers change behavior outside the underflow case.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sunrpc/xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"e6267cccd7b05cc514e57f2160aa8db85f5c2701\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"ad0cce80d4af2f74674e8b635d97aa3880e83da8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"85e9602650e9df07190abe817cee3b4d9bc3df17\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c190e2f913f038c9c91ee63b59cd037260ba353\",\"lessThan\":\"3f491306dcb673ff5e78e1044ba450c58978774e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sunrpc/xdr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:50:26+00:00",
      "cve": "CVE-2026-89551",
      "id": "CVE-2026-89551",
      "initial_release_date": "2026-09-11T19:44:25.327000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: SUNRPC xdr_buf_trim integer underflow leads to data corruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89551.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-89551

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-13 07:17

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n    fix_len:\n            buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before.  No\ncallers change behavior outside the underflow case."
    }
  ],
  "id": "CVE-2026-89551",
  "lastModified": "2026-09-13T07:17:19.537",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-11T20:19:38.640",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-7GQJ-379Q-CVHQ

Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-13 09:32

Details

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

xdr_buf_trim() trims len bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp:

fix_len:
        buf->len -= (len - trim);

When the caller has set buf->len to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf->len and the unsigned subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches xdr_buf_trim() in exactly that state:

buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);

buf->len is a small wire-derived value while the iov_lens are at page scale, so the per-section loops legitimately consume far more bytes than buf->len records. The wrapped buf->len then propagates as the authoritative stream bound into every downstream XDR decoder.

Fix by clamping the decrement so buf->len bottoms out at zero:

buf->len -= min_t(unsigned int, buf->len, len - trim);

On the normal path where the iov_lens sum to buf->len, (len - trim) is always <= buf->len and the result is identical to before. No callers change behavior outside the underflow case.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89551"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T20:19:38Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n    fix_len:\n            buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before.  No\ncallers change behavior outside the underflow case.",
  "id": "GHSA-7gqj-379q-cvhq",
  "modified": "2026-09-13T09:32:18Z",
  "published": "2026-09-11T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89551"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-89551

Vulnerability from csaf_microsoft - Published: 2026-09-13 01:13 - Updated: 2026-09-13 01:13

Summary

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-89551

Affected products

Under investigation 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-89551 SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89551.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
    "tracking": {
      "current_release_date": "2026-09-13T01:13:20.000Z",
      "generator": {
        "date": "2026-09-13T07:02:34.807Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-89551",
      "initial_release_date": "2026-09-13T01:13:20.000Z",
      "revision_history": [
        {
          "date": "2026-09-13T01:13:20.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "category": "product_name",
            "name": "azl3 kernel 0:6.6.150.1-1.azl3",
            "product": {
              "name": "azl3 kernel 0:6.6.150.1-1.azl3",
              "product_id": "1"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-89551",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "under_investigation": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-89551 SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89551.json"
        }
      ],
      "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-89551 (GCVE-0-2026-89551)

FKIE_CVE-2026-89551

GHSA-7GQJ-379Q-CVHQ

MSRC_CVE-2026-89551

Tags

Sightings

Nomenclature