CVE-2026-45870: Linux Kernel SUNRPC Memory Leak Vulnerability

CVE-2026-45870 Overview

CVE-2026-45870 is a memory leak vulnerability in the Linux kernel's SUNRPC auth_gss subsystem. The flaw resides in the XDR decoding error paths used by the GSS-API upcall mechanism. Specifically, the gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory through gssx_dec_buffer(), which internally calls kmemdup(). When a subsequent decode operation fails, these functions return immediately without freeing previously allocated buffers. Repeated failure conditions can exhaust kernel memory over time, degrading system stability on hosts using GSS-authenticated RPC such as NFS with Kerberos.

Critical Impact
Repeated GSS XDR decoding failures leak kernel memory, potentially leading to resource exhaustion and denial of service on systems using Kerberos-authenticated NFS or other SUNRPC services.

Affected Products

Linux kernel SUNRPC subsystem (net/sunrpc/auth_gss)
Systems using rpc.gssd upcalls for GSS-API context negotiation
NFS deployments configured with Kerberos (krb5, krb5i, krb5p) authentication

Discovery Timeline

2026-05-27 - CVE-2026-45870 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45870

Vulnerability Analysis

The vulnerability lives in the GSS proxy XDR decoding path within the kernel's SUNRPC authentication code. The decoder functions gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() decode multiple sub-fields sequentially. Each call to gssx_dec_buffer() allocates a fresh kernel buffer via kmemdup() to hold the decoded data. If a later decode step fails, the function returns the error directly without releasing buffers allocated earlier in the same call. The leaked allocations are no longer referenced by any caller and cannot be reclaimed until reboot.

Root Cause

The root cause is missing cleanup logic on error paths [CWE-401: Missing Release of Memory after Effective Lifetime]. The decode helpers were written under an implicit assumption that callers would not initialize buffer length fields, so a failure would not leave dangling allocations. However, gssp_accept_sec_context_upcall() initializes exported_context_token.len, mech.len, src_name.display_name.len, and targ_name.display_name.len to non-zero values. Each non-zero length triggers an allocation inside gssx_dec_buffer(). When gssx_dec_name() succeeds for src_name but fails for targ_name, the buffers backing exported_context_token, mech, and src_name.display_name become unreachable.

Attack Vector

A local or remote actor able to drive malformed GSS responses through the kernel decoder can trigger the leak on each failed decode. In practice, this occurs when rpc.gssd returns crafted or corrupted upcall payloads, or when an attacker controls an intermediary RPC service. Sustained triggering exhausts kernel memory, producing a denial-of-service condition. The vulnerability does not yield code execution or privilege escalation. The patch introduces goto-based cleanup blocks so each decoder frees previously allocated buffers before returning an error.

No public proof-of-concept code is available. Refer to the upstream commits such as Kernel Git Commit 3b56eb90 and Kernel Git Commit df10f23d for the corrective patches.

Detection Methods for CVE-2026-45870

Indicators of Compromise

Sustained growth of kernel slab allocations attributable to kmalloc-* caches without corresponding workload increase
Repeated rpc.gssd upcall failures recorded in /var/log/messages or journalctl -u rpc-gssd
Elevated kfree/kmemdup imbalance visible through /proc/slabinfo on long-running NFS clients and servers

Detection Strategies

Monitor MemAvailable and Slab values in /proc/meminfo for unexplained downward trends on hosts running Kerberos-authenticated NFS
Use kmemleak (CONFIG_DEBUG_KMEMLEAK=y) on test systems to confirm unfreed allocations originating from gssx_dec_buffer
Correlate kernel version (uname -r) against the fixed stable branches referenced in the upstream commits

Monitoring Recommendations

Track repeated GSS context acceptance failures via SUNRPC tracepoints such as rpcgss:rpcgss_context and rpcgss:rpcgss_import_ctx
Alert on slow but linear kernel memory growth on NFS/Kerberos servers, particularly under authentication churn
Ingest kernel and RPC daemon logs into a centralized log platform for longitudinal analysis of decode error rates

How to Mitigate CVE-2026-45870

Immediate Actions Required

Apply the upstream stable kernel updates that introduce goto-based cleanup in the affected gssx_dec_* functions
Inventory hosts that mount NFS with sec=krb5, krb5i, or krb5p and prioritize them for patching
Reboot patched systems to clear any kernel memory already leaked prior to remediation

Patch Information

The fix is distributed across multiple stable branches. Reference commits include Kernel Git Commit 3b56eb90, Kernel Git Commit 3e6397b0, Kernel Git Commit 64303b92, Kernel Git Commit b4af3806, Kernel Git Commit c81431b1, Kernel Git Commit caf7eff4, Kernel Git Commit d79b9097, and Kernel Git Commit df10f23d. Consult your distribution security tracker for the corresponding backported package version.

Workarounds

Where patching must be deferred, schedule periodic reboots of NFS clients and servers to reclaim leaked kernel memory
Restrict exposure of rpc.gssd to trusted endpoints and avoid intermediaries that can deliver malformed GSS payloads
Where Kerberos is not required, temporarily switch NFS exports to non-GSS authentication to bypass the affected code path

bash

# Verify kernel version contains the fix and inspect GSS-related slab usage
uname -r
grep -E 'kmalloc|sunrpc' /proc/slabinfo
journalctl -u rpc-gssd --since '24 hours ago' | grep -i 'error\|fail'