CVE-2026-89538: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89538 Overview

CVE-2026-89538 is a Linux kernel vulnerability in the SUNRPC subsystem's Kerberos v5 (krb5) GSS-API implementation. The flaw resides in gss_krb5_unwrap_v2(), which processes krb5 v2 wrap tokens used by NFS and other RPC-based services. When the token's 16-bit extra count (ec) field exceeds the plaintext length, the function calls xdr_buf_trim() on data that leaves the xdr_buf in a semantically invalid state with zero length and inconsistent iov lengths. Any peer holding a valid GSS context can legitimately encrypt such a malformed token, bypassing the post-decrypt integrity check. The upstream fix rejects oversized ec tokens with GSS_S_DEFECTIVE_TOKEN before invoking xdr_buf_trim().

Critical Impact
An authenticated peer with a valid GSS context can send a structurally malformed krb5 v2 wrap token that leaves kernel RPC buffers in an inconsistent state, enabling potential downstream memory corruption or denial of service.

Affected Products

Linux kernel SUNRPC subsystem (net/sunrpc/auth_gss)
NFS clients and servers using krb5, krb5i, or krb5p security flavors
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89538 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89538

Vulnerability Analysis

The vulnerability affects the RFC 4121 Kerberos v5 GSS-API wrap token unwrapping path in the Linux kernel SUNRPC layer. gss_krb5_unwrap_v2() sets buf->len to a logical length that can be much smaller than head[0].iov_len, which represents the allocated receive-page capacity. The function then calls xdr_buf_trim() using a trim length derived from the token's 16-bit ec field.

The ec field is authenticated via a post-decrypt memcmp() against the encrypted header copy, so random mutation is rejected. However, any authenticated peer holding a valid GSS context can legitimately encrypt a token whose ec value exceeds the plaintext length. Per RFC 4121, such a token is structurally malformed, but the kernel accepts it and proceeds to trim.

Root Cause

The root cause is missing bounds validation on the ec field prior to buffer manipulation. While xdr_buf_trim() clamps the subtraction from buf->len to prevent unsigned underflow, the buffer is left with zero length and inconsistent iov lengths. Additionally, comparing the trim length against buf->len alone (rather than buf->len - offset) leaves an offset-wide window in which an oversized ec passes validation and xdr_buf_trim() cuts into bytes preceding the wrapped blob. This is an [CWE-20] Improper Input Validation issue that produces downstream memory state corruption.

Attack Vector

Exploitation requires an active GSS security context, meaning the attacker must be an authenticated RPC peer such as an NFS client or server that has completed krb5 authentication. The attacker crafts a wrap token with a valid MIC and encrypted payload but sets the ec field to a value exceeding the plaintext length. When the victim kernel unwraps the token, the SUNRPC receive buffer is corrupted, potentially affecting subsequent RPC processing or triggering downstream faults.

The vulnerability manifests entirely in kernel context within the RPC receive path. Refer to the upstream kernel fix commit for the exact patched code path.

Detection Methods for CVE-2026-89538

Indicators of Compromise

Unexpected GSS_S_DEFECTIVE_TOKEN errors in dmesg or RPC debug logs from authenticated NFS peers after patching.
Kernel stack traces or oops messages originating from gss_krb5_unwrap_v2 or xdr_buf_trim code paths.
NFS session instability, mount hangs, or unexplained RPC disconnections tied to specific krb5-authenticated peers.

Detection Strategies

Audit installed kernel package versions against the vendor advisories for each Linux distribution in use.
Monitor SUNRPC and rpc.gssd debug output for anomalous wrap token decode failures on servers exposing krb5p or krb5i mounts.
Correlate NFS client identity with RPC error patterns to identify compromised or misbehaving authenticated peers.

Monitoring Recommendations

Enable SUNRPC debugging via rpcdebug -m rpc -s auth on affected systems during triage windows.
Ingest kernel logs into a centralized logging pipeline and alert on gss_krb5 error signatures.
Track NFS mount stability metrics and correlate outages with krb5 authentication events.

How to Mitigate CVE-2026-89538

Immediate Actions Required

Inventory all Linux systems running NFS with krb5, krb5i, or krb5p security flavors and prioritize them for patching.
Apply the stable kernel update containing the referenced fix commits from your distribution vendor.
Restrict RPC access to trusted network segments while patching is in progress.

Patch Information

The upstream fix rejects oversized ec tokens before calling xdr_buf_trim(), returning GSS_S_DEFECTIVE_TOKEN and keeping the xdr_buf internally consistent. The patch also corrects the comparison to use buf->len - offset rather than buf->len alone, eliminating the offset-wide validation window. Fix commits are available at 1f9856af065b, 4abb44a29bb5, 880effc943ed, 9fc6d6e6db49, ac9efc29346b, ad484748eec0, b5746095b59f, and dfcd81ab4561.

Workarounds

Limit RPC and NFS exposure to trusted networks using host firewalls or network segmentation until kernel updates can be deployed.
Where operationally feasible, temporarily switch to non-Kerberos security flavors or reduce the number of authenticated peers permitted to establish GSS contexts.
Rotate and audit Kerberos principals for NFS services to ensure only trusted hosts hold valid GSS credentials.

bash

# Verify running kernel version and confirm patch application
uname -r
# Example: check for fix commit in kernel changelog
rpm -q --changelog kernel | grep -i 'gss_krb5_unwrap_v2\|krb5 v2 wrap'
# Restrict NFS/RPC access at the firewall during patch rollout
firewall-cmd --permanent --remove-service=nfs
firewall-cmd --permanent --remove-service=rpc-bind
firewall-cmd --reload