CVE-2026-89542 Overview
CVE-2026-89542 is a memory safety vulnerability in the Linux kernel's SUNRPC subsystem, specifically in the gss_krb5_unwrap_v2() function that handles Kerberos v5 GSS-API token unwrapping. The function reads the Extra Count (EC) and Right Rotation Count (RRC) header fields at offsets ptr+4 and ptr+6 before validating that the token meets the minimum length of GSS_KRB5_TOK_HDR_LEN (16 bytes). A short or malformed token triggers out-of-bounds reads, an unsigned integer wrap in rotate_left(), a divide-by-zero in _rotate_left(), and an ineffective BUG_ON check that fails to catch an underflow driving a ~UINT_MAX-byte memmove().
Critical Impact
A network-reachable attacker can trigger memory corruption in the kernel's SUNRPC GSS-Kerberos path by sending a crafted short token, potentially leading to remote code execution or system crash.
Affected Products
- Linux kernel with SUNRPC GSS-Kerberos v5 support enabled
- Systems using NFS with sec=krb5, krb5i, or krb5p mount options
- Distributions shipping unpatched kernels referenced in the upstream stable commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89542 published to the National Vulnerability Database
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89542
Vulnerability Analysis
The vulnerability resides in net/sunrpc/auth_gss/gss_krb5_wrap.c within gss_krb5_unwrap_v2(). The function processes wrapped Kerberos tokens received over RPC and unwraps them for consumption by upper-layer callers. It performs three unchecked operations against attacker-controlled length fields.
First, the function dereferences ptr+4 (EC) and ptr+6 (RRC) before verifying that len - offset is at least GSS_KRB5_TOK_HDR_LEN. A token shorter than 16 bytes causes an out-of-bounds read from the head iovec. Second, the rotate_left() helper computes buf->len - base as an unsigned value and passes it to xdr_buf_subsegment(); when base > buf->len, the subtraction wraps to a value near UINT_MAX. Third, _rotate_left() executes shift %= buf->len without checking whether buf->len is zero, producing a divide-by-zero fault.
After decryption, the cleanup arithmetic recomputes movelen using unsigned subtraction. The existing BUG_ON re-adds the value just subtracted, reducing to min(A, B) > A, which is always false. The underflowed movelen then drives a memmove() of approximately 4 GiB, corrupting kernel memory.
Root Cause
The root cause is missing input validation on untrusted length fields inside a decryption path reachable over the network. The class of defect combines an out-of-bounds read, an integer underflow, and a division-by-zero condition, all guarded only by an arithmetically dead BUG_ON assertion.
Attack Vector
An attacker with the ability to send RPC traffic to a vulnerable host, such as an NFS client or server negotiating krb5, krb5i, or krb5p security flavors, can supply a malformed wrap token whose declared length is smaller than the header size or leaves the rotation base past the end of the buffer. The malformed token triggers kernel memory corruption without requiring authentication in configurations where GSS negotiation precedes credential validation.
No verified public proof-of-concept is available. Refer to the upstream patch commits for the exact code paths and validation logic added by the fix.
Detection Methods for CVE-2026-89542
Indicators of Compromise
- Kernel oops or panic entries in dmesg referencing gss_krb5_unwrap_v2, rotate_left, xdr_buf_subsegment, or _rotate_left
- Divide-by-zero exceptions originating in the SUNRPC auth_gss module
- Unexpected NFS client or server crashes coincident with inbound RPC traffic using Kerberos security flavors
Detection Strategies
- Monitor kernel logs for BUG:, Oops:, or divide error messages tagged to the SUNRPC subsystem
- Correlate kernel faults with network flows to RPC ports 111 and 2049 using Kerberos GSS authentication
- Inspect crash dumps for stack frames traversing gss_krb5_unwrap_v2 and memmove with abnormally large size arguments
Monitoring Recommendations
- Enable kernel crash collection with kdump on NFS servers and diskless clients that rely on krb5 mounts
- Alert on repeated SUNRPC-related kernel warnings from the same source IP, which may indicate probing
- Track kernel package versions across the fleet to confirm all hosts have received the fix commits
How to Mitigate CVE-2026-89542
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the fix commits and reboot affected systems
- Inventory hosts using NFS with krb5, krb5i, or krb5p and prioritize them for patching
- Restrict inbound RPC traffic to trusted network segments until patches are deployed
Patch Information
The fix adds four defense-in-depth guards inside the unwrap core: rejecting tokens where len - offset < GSS_KRB5_TOK_HDR_LEN before touching ptr+4/ptr+6; bailing from rotate_left() when buf->len <= base; returning early from _rotate_left() when buf->len is zero; and replacing the dead BUG_ON with a live check that returns GSS_S_DEFECTIVE_TOKEN before the movelen subtraction. See Kernel Change Commit 075d7cf, Kernel Change Commit 299d281, Kernel Change Commit 6959297, Kernel Change Commit 806584a, Kernel Change Commit 84ddbc8, Kernel Change Commit a7894e1, Kernel Change Commit dddcb0f, and Kernel Change Commit f259166.
Workarounds
- Disable Kerberos-based NFS security flavors and revert to sys where security requirements allow, until patches are applied
- Use host-based firewall rules to restrict RPC ports (111, 2049) to known-good client subnets
- Unload or blacklist the rpcsec_gss_krb5 module on hosts that do not require Kerberos-authenticated RPC
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
