CVE-2026-89541: Linux Kernel SUNRPC Buffer Overflow Vulnerability

CVE-2026-89541 Overview

CVE-2026-89541 is a Linux kernel vulnerability in the SUNRPC subsystem's gss_unwrap_resp_priv() function. The flaw arises from a u32 integer overflow in the RPCSEC_GSS opaque length validation. A malicious krb5p NFS server can return a crafted RPCSEC_GSS reply that bypasses the boundary check and triggers out-of-bounds reads in gss_krb5_unwrap_v2() and the subsequent rotate_left() loop. The vulnerability affects Linux NFS clients that mount from untrusted or compromised Kerberos-protected NFS servers.

Critical Impact
A hostile NFS server can drive a client kernel into out-of-bounds memory reads over the network without authentication of the underlying token content, enabling denial of service or information disclosure.

Affected Products

Linux kernel SUNRPC subsystem with RPCSEC_GSS support
NFS clients using Kerberos privacy (krb5p) mounts
Multiple stable kernel branches (fix backported across eight commits)

Discovery Timeline

2026-09-11 - CVE-2026-89541 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89541

Vulnerability Analysis

The vulnerable function gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length using a single combined comparison: offset + opaque_len > rcv_buf->len. Both operands are u32, and the addition is performed in unsigned 32-bit arithmetic. When opaque_len approaches 0xffffffff, the sum wraps around to a small value that falsely satisfies the bound check.

Once the check passes, gss_unwrap() is invoked with end < begin, producing an inverted range that downstream code interprets as valid. The check also lacks a lower bound, so any opaque_len in the range [0, GSS_KRB5_TOK_HDR_LEN) reaches gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4 and ptr+6 run past the end of the token.

Root Cause

The root cause is an integer overflow in unsigned 32-bit arithmetic combined with a missing minimum-length guard. The single expression offset + opaque_len cannot detect wrap-around, and the absence of a floor check against GSS_KRB5_TOK_HDR_LEN allows undersized tokens to reach header-parsing routines that assume the RFC 4121 minimum outer token length.

Attack Vector

Exploitation requires a client to mount an NFS share from an attacker-controlled server using Kerberos privacy (krb5p). The server returns a crafted RPCSEC_GSS reply with an opaque_len chosen to trigger wrap-around or to fall below the token header size. The client then performs out-of-bounds reads inside gss_krb5_unwrap_v2() and the subsequent rotate_left() loop, which can leak kernel memory or crash the client.

The upstream fix replaces the combined check with three separate guards that are safe in u32 arithmetic and enforce the RFC 4121 minimum outer token length. The first guard validates offset against rcv_buf->len, the second uses subtraction rather than addition to check opaque_len, and the third enforces the GSS_KRB5_TOK_HDR_LEN floor. See the technical references for the kernel commits implementing this patch.

Detection Methods for CVE-2026-89541

Indicators of Compromise

Unexpected kernel oops or panic traces referencing gss_unwrap_resp_priv, gss_krb5_unwrap_v2, or rotate_left on NFS client hosts
NFS client mounts to untrusted or externally hosted krb5p-protected shares
Repeated RPCSEC_GSS unwrap failures logged in kernel ring buffer from a single server

Detection Strategies

Audit /proc/mounts and /etc/fstab for sec=krb5p NFS mounts and validate that server endpoints are trusted
Correlate kernel warnings from the SUNRPC subsystem with the remote NFS server address to identify malicious peers
Monitor endpoint telemetry for unexplained NFS client crashes coinciding with reads from specific remote hosts

Monitoring Recommendations

Forward dmesg and journald kernel messages to a central log platform and alert on SUNRPC or gss_krb5 stack traces
Track NFS client version distribution across the fleet to prioritize patch rollout
Watch for anomalous outbound connections from Linux hosts to NFS servers outside sanctioned network ranges

How to Mitigate CVE-2026-89541

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits 3691c4b3, 401f6a5b, 81fd7654, 85fa6b12, 87831b92, 89a15a50, d395c30d, and ebcbd252
Restrict Kerberos-protected NFS mounts to trusted, network-segmented servers under organizational control
Reboot affected NFS client hosts after installing patched kernel packages

Patch Information

The fix has been merged into multiple stable Linux kernel branches. Distribution vendors ship the corrected gss_unwrap_resp_priv() implementation with three separated bound checks. Review the Kernel Commit 3691c4b, Kernel Commit 401f6a5b, Kernel Commit 81fd7654, Kernel Commit 85fa6b12, Kernel Commit 87831b92, Kernel Commit 89a15a50, Kernel Commit d395c30d, and Kernel Commit ebcbd252 for backport details.

Workarounds

Avoid mounting NFS shares with sec=krb5p from servers outside administrative control until patches are applied
Enforce network egress policy to prevent Linux clients from reaching untrusted NFS servers on TCP/2049
Where feasible, temporarily switch to sec=krb5i or non-Kerberos transports on paths that do not require encryption, then re-enable krb5p after patching

bash

# Verify running kernel version and NFS mount security flavors
uname -r
findmnt -t nfs,nfs4 -o TARGET,SOURCE,OPTIONS | grep -i krb5p