CVE-2026-89537 Overview
CVE-2026-89537 is an out-of-bounds read vulnerability in the Linux kernel's SUNRPC subsystem. The flaw resides in the gss_krb5_verify_mic_v2() function, which processes RFC 4121 Message Integrity Code (MIC) tokens without validating token length. A malicious NFS server or RPC peer can supply a short MIC token, causing the Kerberos verifier to read past the end of a small slab allocation.
Critical Impact
A network-adjacent attacker with no authentication can trigger out-of-bounds reads in kernel memory through crafted RFC 4121 MIC tokens, potentially causing kernel crashes or information disclosure across NFS and RPC connections.
Affected Products
- Linux kernel SUNRPC subsystem
- Systems using Kerberos-secured NFS (krb5, krb5i, krb5p)
- RPC services relying on gss_krb5_verify_mic_v2()
Discovery Timeline
- 2026-09-11 - CVE-2026-89537 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89537
Vulnerability Analysis
The defect exists in gss_krb5_verify_mic_v2() within the Linux kernel SUNRPC GSS-API implementation. The function reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding bytes at ptr[3..7]. It then passes ptr + GSS_KRB5_TOK_HDR_LEN along with cksum_len to gss_krb5_mic_build_sg(). None of these accesses first verify read_token->len.
The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16 bytes) plus ctx->krb5e->cksum_len (12 to 24 bytes depending on the encryption type). When callers accept shorter wire tokens, the verifier walks beyond the allocated buffer.
Root Cause
Multiple call paths fail to enforce a lower bound on token length before invoking gss_verify_mic(). gss_unwrap_resp_integ() enforces only an upper bound before allocating mic.data = kmalloc(len). gss_validate() checks only that len <= RPC_MAX_AUTH_SIZE (400). svcauth_gss_verify_header() requires only checksum.len >= XDR_UNIT (4 bytes). svcauth_gss_unwrap_integ() confirms only that the checksum fits in gsd->gsd_scratch.
Attack Vector
A malicious NFS server or RPC peer supplies a MIC token shorter than the required header plus checksum length. The kernel allocates a small slab buffer sized to the attacker-controlled length. gss_krb5_verify_mic_v2() then reads past the allocation while parsing the token header and constructing the scatterlist for checksum verification. This produces slab out-of-bounds reads reachable over the network without authentication.
The fix adds an explicit length guard at the top of gss_krb5_verify_mic_v2() before any ptr[] access or scatterlist construction. Well-formed tokens produced by gss_krb5_get_mic_v2() already contain exactly GSS_KRB5_TOK_HDR_LEN + cksum_len bytes, so legitimate traffic is unaffected. See the upstream commits 7a946b2 and b94f671 for the fix.
Detection Methods for CVE-2026-89537
Indicators of Compromise
- Kernel KASAN reports referencing gss_krb5_verify_mic_v2 or gss_krb5_mic_build_sg with slab-out-of-bounds signatures
- Repeated NFS or RPC authentication failures immediately preceding kernel oops or panic events
- Unexpected SUNRPC decoding errors in dmesg from Kerberos-authenticated mounts
Detection Strategies
- Monitor kernel logs on NFS clients and servers for GSS-API verification errors and stack traces referencing SUNRPC Kerberos routines
- Inspect RPC traffic for MIC opaque fields shorter than 28 bytes (16-byte header plus minimum 12-byte checksum) from untrusted peers
- Correlate NFS mount targets with peer reputation to identify connections to untrusted or unexpected servers
Monitoring Recommendations
- Enable KASAN on test kernels to surface out-of-bounds reads triggered by malformed RPC traffic
- Ingest dmesg and auditd events into a centralized log platform and alert on SUNRPC or GSS-API stack traces
- Track kernel version inventory across Linux hosts to identify systems still exposed to CVE-2026-89537
How to Mitigate CVE-2026-89537
Immediate Actions Required
- Apply the upstream Linux kernel patches from commits 7a946b2 and b94f671 or install vendor-provided kernel updates
- Restrict NFS and RPC connections to trusted networks and authenticated peers only
- Audit /etc/fstab and automount configurations for Kerberos-secured mounts pointing to untrusted servers
Patch Information
The upstream fix adds a length guard at the top of gss_krb5_verify_mic_v2() that rejects tokens shorter than GSS_KRB5_TOK_HDR_LEN + cksum_len before any pointer dereference or scatterlist construction. Distribution maintainers should backport commits 7a946b2 and b94f671 to affected stable branches. Administrators should update to the fixed kernel version supplied by their Linux distribution.
Workarounds
- Disable Kerberos-authenticated NFS (sec=krb5, krb5i, krb5p) where operationally feasible until patches are deployed
- Use host-based firewall rules to block inbound RPC and NFS traffic from untrusted sources
- Segment NFS clients and servers on dedicated management networks to reduce exposure to malicious peers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
