GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-89542

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-14 13:19
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN (16) bytes long, and its rotate_left() helper passes buf->len - base to xdr_buf_subsegment() without verifying that base <= buf->len. When a caller hands in a sub-16-byte token, or a token whose declared len leaves base past the end of the buffer, three distinct failures follow: gss_krb5_unwrap_v2(offset, len, buf) ptr = buf->head[0].iov_base + offset ec = *(ptr + 4) /* OOB read on short head */ rrc = *(ptr + 6) /* OOB read on short head */ rotate_left(offset + 16, buf, rrc) xdr_buf_subsegment(buf, &subbuf, base, buf->len - base) /* u32 wrap when base > len */ _rotate_left(&subbuf, shift) shift %= buf->len /* divide-by-zero when base == len */ After decryption, the cleanup arithmetic has the same shape: movelen = min_t(unsigned int, buf->head[0].iov_len, len); movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip; BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen > buf->head[0].iov_len); The BUG_ON re-adds the value just subtracted, so it reduces to min(A, B) > A and is permanently false; it cannot catch the unsigned underflow of movelen, which then drives a ~UINT_MAX-byte memmove(). Add four defense-in-depth guards inside the unwrap core so it is safe regardless of what its callers validate: - reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before touching ptr+4/ptr+6; - bail from rotate_left() when buf->len <= base, covering both the underflow and zero-length cases; - return early from _rotate_left() when buf->len is zero, so the shift %= buf->len modulo cannot fault; - replace the dead BUG_ON with a live check that returns GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_krb5_wrap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "299d281c7225ded15b28cb861a98d818d82787fc",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "84ddbc8d084c0251d534f14f5d1a7da05be56404",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "075d7cfc4df8c54cb202ba8b28420370c03ba9b6",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "f2591660e0eb263c9415bf0d0bb1b111e62df7a4",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "806584a4b67a7233870c33e5b8f872e76dd02988",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "a7894e10572d53eb10109b8d07459cc8d3435811",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            },
            {
              "lessThan": "6959297aaa9572783d620a226d73c3fb94494888",
              "status": "affected",
              "version": "de9c17eb4a912c9028f7b470eb80815144883b26",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_krb5_wrap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_krb5_unwrap_v2 against short tokens\n\ngss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and\nptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN\n(16) bytes long, and its rotate_left() helper passes buf-\u003elen - base\nto xdr_buf_subsegment() without verifying that base \u003c= buf-\u003elen. When\na caller hands in a sub-16-byte token, or a token whose declared len\nleaves base past the end of the buffer, three distinct failures follow:\n\n    gss_krb5_unwrap_v2(offset, len, buf)\n      ptr = buf-\u003ehead[0].iov_base + offset\n      ec  = *(ptr + 4)              /* OOB read on short head */\n      rrc = *(ptr + 6)              /* OOB read on short head */\n      rotate_left(offset + 16, buf, rrc)\n        xdr_buf_subsegment(buf, \u0026subbuf,\n                           base, buf-\u003elen - base)   /* u32 wrap when base \u003e len */\n        _rotate_left(\u0026subbuf, shift)\n          shift %= buf-\u003elen         /* divide-by-zero when base == len */\n\nAfter decryption, the cleanup arithmetic has the same shape:\n\n    movelen = min_t(unsigned int, buf-\u003ehead[0].iov_len, len);\n    movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;\n    BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen \u003e\n                                            buf-\u003ehead[0].iov_len);\n\nThe BUG_ON re-adds the value just subtracted, so it reduces to\nmin(A, B) \u003e A and is permanently false; it cannot catch the unsigned\nunderflow of movelen, which then drives a ~UINT_MAX-byte memmove().\n\nAdd four defense-in-depth guards inside the unwrap core so it is safe\nregardless of what its callers validate:\n\n  - reject tokens with len - offset \u003c GSS_KRB5_TOK_HDR_LEN before\n    touching ptr+4/ptr+6;\n  - bail from rotate_left() when buf-\u003elen \u003c= base, covering both the\n    underflow and zero-length cases;\n  - return early from _rotate_left() when buf-\u003elen is zero, so the\n    shift %= buf-\u003elen modulo cannot fault;\n  - replace the dead BUG_ON with a live check that returns\n    GSS_S_DEFECTIVE_TOKEN before the movelen subtraction."
    }
  ],
  "id": "CVE-2026-89542",
  "lastModified": "2026-09-14T13:19:09.370",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-11T20:19:37.380",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.