CVE-2026-45964: Linux Kernel SUNRPC Kref Leak Vulnerability

CVE-2026-45964 Overview

CVE-2026-45964 is a reference-counting flaw in the Linux kernel's SUNRPC (Sun Remote Procedure Call) subsystem. The defect resides in the gss_alloc_msg() function within auth_gss.c and produces a kref leak on a specific error path. When service_name is non-NULL and the kstrdup_const() call fails, control jumps to the err_put_pipe_version label, which releases the pipe version and frees gss_msg but never decrements the gss_auth->kref taken earlier in the function. The leaked reference prevents the gss_auth structure from ever being freed, producing a kernel memory leak [CWE-401] over time.

Critical Impact
Repeated failures in gss_alloc_msg() cause persistent kernel memory consumption and may degrade or destabilize systems relying on RPCSEC_GSS authentication for NFS and other SUNRPC services.

Affected Products

Linux kernel SUNRPC subsystem (net/sunrpc/auth_gss/auth_gss.c)
Kernels containing commit 5940d1cf9f42 ("SUNRPC: Rebalance a kref in auth_gss.c")
Distributions shipping affected stable kernel branches prior to the fix commits

Discovery Timeline

2026-05-27 - CVE-2026-45964 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45964

Vulnerability Analysis

The SUNRPC GSS (Generic Security Services) layer uses gss_auth reference counts to manage the lifetime of authentication state shared between upcall messages and RPC clients. Commit 5940d1cf9f42 added a kref_get(&gss_auth->kref) to balance the gss_put_auth() performed inside gss_release_msg(). That rebalance assumes every cleanup path will eventually run gss_release_msg(). The error path introduced for kstrdup_const() failure violates that assumption.

When allocation of the service name string fails, gss_alloc_msg() does not invoke gss_release_msg(). Instead it jumps directly to err_put_pipe_version, calls put_pipe_version(), frees gss_msg, and returns an error. The previously acquired gss_auth reference is never released. Each failing call therefore leaves an extra reference on gss_auth, preventing gss_free_callback() from ever firing and pinning the structure indefinitely.

Root Cause

The root cause is asymmetric reference handling on an error path. A reference is acquired unconditionally near the top of gss_alloc_msg(), but only the success path and certain failure paths route through gss_release_msg() to drop it. The kstrdup_const() failure branch was not updated when the rebalancing patch landed, leaving a missing kref_put() on gss_auth->kref before returning.

Attack Vector

Triggering the leak requires kstrdup_const() to fail, which typically occurs under memory pressure or via fault injection. Unprivileged local processes that invoke RPCSEC_GSS authentication, such as NFS clients, can repeatedly cause gss_alloc_msg() to run while the system is under stress. Sustained failures accumulate leaked gss_auth references and pinned memory. The fix adds a forward declaration of gss_free_callback() and inserts a kref_put() call in the err_put_pipe_version branch to restore symmetric reference handling.

Detection Methods for CVE-2026-45964

Indicators of Compromise

Steadily increasing kernel slab allocations associated with SUNRPC GSS authentication objects without a corresponding workload increase.
Persistent gss_auth structures visible through kernel debugging interfaces (/sys/kernel/slab, kmemleak) that outlive the RPC clients that created them.
Repeated -ENOMEM returns from RPCSEC_GSS upcall paths logged via dmesg or audit subsystems.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on non-production kernels and look for leak reports referencing auth_gss.c and gss_alloc_msg.
Monitor /proc/slabinfo for unbounded growth in SUNRPC-related caches on hosts that perform Kerberos-authenticated NFS mounts.
Correlate kernel version inventory against the fix commits (3b2b6c4, 655c9ba9, a1bc9561, a2d4e9a7, b559be2e, c20f9252, dd2fdc35, e464e26b) to identify unpatched hosts.

Monitoring Recommendations

Track host-level kernel memory usage trends and alert on sustained slab growth on NFS clients and servers.
Capture syslog and audit events for RPCSEC_GSS failures and memory allocation errors during periods of pressure.
Maintain an inventory of Linux kernel build versions across the fleet so patched and unpatched hosts can be distinguished quickly.

How to Mitigate CVE-2026-45964

Immediate Actions Required

Apply the upstream stable kernel updates that include the gss_alloc_msg reference-leak fix and reboot affected systems.
Prioritize patching NFS servers, NFS clients, and any host using RPCSEC_GSS authentication.
Validate after patching by exercising NFS mounts and confirming SUNRPC slab caches stabilize under load.

Patch Information

The issue is fixed in the Linux kernel by adding a forward declaration of gss_free_callback() and calling kref_put(&gss_auth->kref, gss_free_callback) in the err_put_pipe_version path of gss_alloc_msg(). Stable backports are available in the following commits: Linux Kernel Commit 3b2b6c4, Linux Kernel Commit 655c9ba9, Linux Kernel Commit a1bc9561, Linux Kernel Commit a2d4e9a7, Linux Kernel Commit b559be2e, Linux Kernel Commit c20f9252, Linux Kernel Commit dd2fdc35, and Linux Kernel Commit e464e26b.

Workarounds

Where patching is delayed, avoid configurations that exercise RPCSEC_GSS authentication under sustained memory pressure.
Restart affected services or reboot hosts periodically to reclaim leaked gss_auth allocations until the fix is deployed.
Disable Kerberos-authenticated NFS mounts on non-critical systems if the workload permits, reverting once the patched kernel is in place.

bash

# Verify the running kernel version and check whether the fix commit is present
uname -r
# Inspect SUNRPC slab caches for unexpected growth
grep -E 'rpc|gss' /proc/slabinfo
# Enable kmemleak scanning on a test host to confirm the fix
echo scan > /sys/kernel/debug/kmemleak && cat /sys/kernel/debug/kmemleak