CVE-2026-89539: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89539 Overview

CVE-2026-89539 is a memory leak vulnerability in the Linux kernel's SUNRPC subsystem. The flaw resides in gssx_dec_option_array(), which processes GSS-Proxy reply option arrays. When a reply contains multiple CREDS_VALUE entries, the helper gssx_dec_linux_creds() overwrites creds->cr_group_info on each iteration without releasing the previously allocated group_info structure. The orphaned kvmalloc-backed storage is never freed, since free_svc_cred() only releases the last installed pointer.

Critical Impact
A malformed GSS-Proxy reply carrying duplicate CREDS_VALUE options triggers a kernel memory leak in kvmalloc-backed storage, contributing to resource exhaustion over time.

Affected Products

Linux kernel SUNRPC subsystem
Systems using GSS-Proxy (gssp_accept_sec_context_upcall())
Kernel builds prior to the fix commits referenced in the stable tree

Discovery Timeline

2026-09-11 - CVE-2026-89539 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89539

Vulnerability Analysis

The SUNRPC (Sun Remote Procedure Call) code in the Linux kernel decodes option arrays returned from GSS-Proxy over the wire. The function gssx_dec_option_array() iterates through every entry and, when the entry name matches CREDS_VALUE, dispatches to gssx_dec_linux_creds(). That helper allocates a new group_info structure using groups_alloc() and assigns it directly to creds->cr_group_info.

The assignment is unconditional. No check ensures the field is currently NULL, and no prior allocation is released. When two CREDS_VALUE entries appear in the same reply, the second decode overwrites the first pointer and orphans the earlier allocation. The cleanup path in free_creds calls free_svc_cred(), which only frees the pointer currently stored in cr_group_info.

No in-tree caller of gssp_accept_sec_context_upcall() expects more than one CREDS_VALUE per reply, so the duplicate case represents malformed or malicious input rather than legitimate protocol usage.

Root Cause

The root cause is missing state tracking during option array decoding. The decoder trusts that CREDS_VALUE appears at most once and never validates that assumption. Combined with the unconditional pointer replacement inside gssx_dec_linux_creds(), this creates a memory leak on every duplicate entry.

Attack Vector

Exploitation requires the ability to influence GSS-Proxy replies processed by the kernel SUNRPC layer. A crafted reply containing two or more CREDS_VALUE options triggers a leak of kvmalloc-backed group_info storage per duplicate entry. Repeated triggering drains kernel memory and can degrade system stability.

Refer to the upstream fix commits for technical details: Kernel Git Commit 2e4ce62, Kernel Git Commit 7a1d050, Kernel Git Commit 9d94f04, and Kernel Git Commit f615b88.

Detection Methods for CVE-2026-89539

Indicators of Compromise

Unexplained growth in kernel slab or kvmalloc allocations attributed to group_info structures.
Repeated GSS-Proxy transactions producing replies with more than one CREDS_VALUE option.
Gradual decline in available kernel memory without matching user-space allocation growth.

Detection Strategies

Audit kernel versions across Linux fleets and correlate against the fixed stable commits.
Enable kernel memory leak detection (kmemleak) on test systems running GSS-Proxy workloads.
Inspect SUNRPC and rpc.gssd telemetry for anomalous or repeated upcall patterns.

Monitoring Recommendations

Monitor /proc/meminfo and /proc/slabinfo for sustained increases without workload change.
Track GSS-Proxy daemon activity and reply payload sizes for outliers.
Alert on kernel warnings from the SUNRPC subsystem indicating decode errors after the patch is applied, since -EINVAL responses will now surface on duplicate CREDS_VALUE entries.

How to Mitigate CVE-2026-89539

Immediate Actions Required

Apply the upstream kernel patches from the stable tree referenced in the external references.
Rebuild and redeploy kernels on systems that use GSS-Proxy or Kerberos-backed NFS with GSS security.
Restrict access to any component capable of injecting crafted GSS-Proxy replies.

Patch Information

The fix tracks whether a CREDS_VALUE option has already been decoded during a single call to gssx_dec_option_array(). Any subsequent match returns -EINVAL, allowing the existing free_creds path to release the single group_info that was installed. The change is present in the stable commits 2e4ce62, 7a1d050, 9d94f04, and f615b88.

Workarounds

Disable GSS-Proxy on systems that do not require Kerberos-authenticated RPC services until the patched kernel is deployed.
Limit exposure of NFS and RPC endpoints that rely on GSS security to trusted networks.
Reboot systems periodically where patching is delayed to reclaim leaked kernel memory.

bash

# Verify running kernel version and check for the fix
uname -r
# Confirm patched commit is present in your distribution's changelog
# before returning affected hosts to production