GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-H928-QW5V-X6VJ

Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-14 15:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN (16) bytes long, and its rotate_left() helper passes buf->len - base to xdr_buf_subsegment() without verifying that base <= buf->len. When a caller hands in a sub-16-byte token, or a token whose declared len leaves base past the end of the buffer, three distinct failures follow:

gss_krb5_unwrap_v2(offset, len, buf)
  ptr = buf->head[0].iov_base + offset
  ec  = *(ptr + 4)              /* OOB read on short head */
  rrc = *(ptr + 6)              /* OOB read on short head */
  rotate_left(offset + 16, buf, rrc)
    xdr_buf_subsegment(buf, &subbuf,
                       base, buf->len - base)   /* u32 wrap when base > len */
    _rotate_left(&subbuf, shift)
      shift %= buf->len         /* divide-by-zero when base == len */

After decryption, the cleanup arithmetic has the same shape:

movelen = min_t(unsigned int, buf->head[0].iov_len, len);
movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
                                        buf->head[0].iov_len);

The BUG_ON re-adds the value just subtracted, so it reduces to min(A, B) > A and is permanently false; it cannot catch the unsigned underflow of movelen, which then drives a ~UINT_MAX-byte memmove().

Add four defense-in-depth guards inside the unwrap core so it is safe regardless of what its callers validate:

  • reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before touching ptr+4/ptr+6;
  • bail from rotate_left() when buf->len <= base, covering both the underflow and zero-length cases;
  • return early from _rotate_left() when buf->len is zero, so the shift %= buf->len modulo cannot fault;
  • replace the dead BUG_ON with a live check that returns GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-89542"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T20:19:37Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_krb5_unwrap_v2 against short tokens\n\ngss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and\nptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN\n(16) bytes long, and its rotate_left() helper passes buf-\u003elen - base\nto xdr_buf_subsegment() without verifying that base \u003c= buf-\u003elen. When\na caller hands in a sub-16-byte token, or a token whose declared len\nleaves base past the end of the buffer, three distinct failures follow:\n\n    gss_krb5_unwrap_v2(offset, len, buf)\n      ptr = buf-\u003ehead[0].iov_base + offset\n      ec  = *(ptr + 4)              /* OOB read on short head */\n      rrc = *(ptr + 6)              /* OOB read on short head */\n      rotate_left(offset + 16, buf, rrc)\n        xdr_buf_subsegment(buf, \u0026subbuf,\n                           base, buf-\u003elen - base)   /* u32 wrap when base \u003e len */\n        _rotate_left(\u0026subbuf, shift)\n          shift %= buf-\u003elen         /* divide-by-zero when base == len */\n\nAfter decryption, the cleanup arithmetic has the same shape:\n\n    movelen = min_t(unsigned int, buf-\u003ehead[0].iov_len, len);\n    movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;\n    BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen \u003e\n                                            buf-\u003ehead[0].iov_len);\n\nThe BUG_ON re-adds the value just subtracted, so it reduces to\nmin(A, B) \u003e A and is permanently false; it cannot catch the unsigned\nunderflow of movelen, which then drives a ~UINT_MAX-byte memmove().\n\nAdd four defense-in-depth guards inside the unwrap core so it is safe\nregardless of what its callers validate:\n\n  - reject tokens with len - offset \u003c GSS_KRB5_TOK_HDR_LEN before\n    touching ptr+4/ptr+6;\n  - bail from rotate_left() when buf-\u003elen \u003c= base, covering both the\n    underflow and zero-length cases;\n  - return early from _rotate_left() when buf-\u003elen is zero, so the\n    shift %= buf-\u003elen modulo cannot fault;\n  - replace the dead BUG_ON with a live check that returns\n    GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.",
  "id": "GHSA-h928-qw5v-x6vj",
  "modified": "2026-09-14T15:32:28Z",
  "published": "2026-09-11T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89542"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/075d7cfc4df8c54cb202ba8b28420370c03ba9b6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/299d281c7225ded15b28cb861a98d818d82787fc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6959297aaa9572783d620a226d73c3fb94494888"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/806584a4b67a7233870c33e5b8f872e76dd02988"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/84ddbc8d084c0251d534f14f5d1a7da05be56404"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a7894e10572d53eb10109b8d07459cc8d3435811"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dddcb0f4b7e27fac16a78ea9a1c8ec2e8a241087"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f2591660e0eb263c9415bf0d0bb1b111e62df7a4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.