CVE-2026-89544 Overview
CVE-2026-89544 is a Linux kernel vulnerability in the SUNRPC subsystem's GSS proxy (gssx) XDR option-array decoder. The flaw involves four coupled defects in gssx_dec_option_array() and its callers that make error paths unsafe. Failure conditions can trigger a NULL pointer dereference in gssp_accept_sec_context_upcall(), leak a refcounted group_info allocation, and expose a latent use-after-free in gssx_dec_linux_creds(). The vulnerability affects Linux systems using RPCSEC_GSS authentication via the GSS proxy daemon, commonly deployed on NFS servers and clients relying on Kerberos authentication.
Critical Impact
An attacker able to induce allocation failures during GSS proxy option-array decoding can crash the kernel via NULL dereference, resulting in denial of service on affected hosts.
Affected Products
- Linux kernel versions containing the vulnerable gssx_dec_option_array() implementation in net/sunrpc/auth_gss/gss_rpc_xdr.c
- Distributions shipping SUNRPC with GSS proxy (gssproxy) support
- Systems using RPCSEC_GSS authentication for NFS or other SUNRPC services
Discovery Timeline
- 2026-09-11 - CVE-2026-89544 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89544
Vulnerability Analysis
The defect resides in gssx_dec_option_array(), the XDR decoder that parses GSS proxy option arrays returned from the userspace gssproxy daemon. The function prematurely sets oa->count = 1 before allocating oa->data. When the allocation fails and returns -ENOMEM, the structure is left in an inconsistent state with count == 1 and data == NULL.
The caller chain gssp_accept_sec_context_upcall() → gssx_dec_accept_sec_context() trusts the count field and immediately dereferences res.options.data[0].value, triggering a NULL pointer dereference in kernel context. Other error paths jump to the free_oa: label, which frees oa->data but similarly leaves oa->count at 1, preserving the same inconsistency.
A second defect exists in free_creds:, where a partially decoded svc_cred is released with a bare kfree(creds). Because gssx_dec_linux_creds() installs a groups_alloc() result into creds->cr_group_info, and that object is kvmalloc-backed and refcounted, only put_group_info() correctly reaches kvfree(). The plain kfree() leaks the entire group_info allocation.
Root Cause
The root cause is improper error-path state management combined with mismatched allocator and refcount teardown [CWE-476, CWE-416, CWE-401]. Fields describing an array's length are updated before the backing allocation succeeds, and cleanup code uses groups_free() and kfree() where refcount-aware put_group_info() and free_svc_cred() are required.
Attack Vector
The vulnerability is reachable through the SUNRPC GSS proxy upcall path. An attacker who can trigger GSS proxy responses under memory pressure, or who controls a malicious gssproxy-facing input, can induce the allocation failure that leaves the option array in the inconsistent state. The subsequent NULL dereference occurs in kernel context and crashes the host. The CVSS vector indicates network-adjacent exploitation impacting availability only, with no confidentiality or integrity impact. EPSS data reports a probability of 0.567% at the 45.771 percentile as of 2026-09-20.
The fix moves the oa->count = 1 assignment below the oa->data allocation, resets oa->count = 0 at free_oa:, replaces kfree(creds) with free_svc_cred(creds) followed by kfree(creds), and switches groups_free() to put_group_info() with pointer clearing in the out_free_groups: path. See the upstream commits for the complete patch: Kernel Git Commit 3ff4536, Kernel Git Commit 5e9a945, and Kernel Git Commit f85a837.
Detection Methods for CVE-2026-89544
Indicators of Compromise
- Kernel oops or panic messages referencing gssx_dec_option_array, gssx_dec_accept_sec_context, or gssp_accept_sec_context_upcall in the call trace
- NULL pointer dereference faults occurring in the net/sunrpc/auth_gss/ module family
- Unexpected gssproxy daemon disconnects correlated with host reboots or SUNRPC service disruption
Detection Strategies
- Monitor kernel ring buffer (dmesg) and journalctl -k for BUG or Oops entries containing SUNRPC GSS symbols
- Compare installed kernel version against distribution security advisories referencing the three upstream stable commits
- Track gssproxy service failures and unexpected termination events on NFS servers using Kerberos authentication
Monitoring Recommendations
- Ingest kernel logs and RPCSEC_GSS telemetry into a centralized log platform to correlate crashes across the fleet
- Alert on repeated -ENOMEM conditions in SUNRPC subsystem logs, which can indicate memory pressure conducive to triggering this defect
- Track host uptime regressions on NFS servers and Kerberos-authenticated RPC endpoints as a proxy signal for exploitation attempts
How to Mitigate CVE-2026-89544
Immediate Actions Required
- Apply the upstream Linux kernel patches or the corresponding distribution updates that incorporate the three stable commits
- Reboot affected hosts after installing the patched kernel to load the corrected SUNRPC module
- Inventory systems running gssproxy and NFS-over-Kerberos configurations to prioritize patching
Patch Information
The upstream fix is available in the stable kernel tree via commits 3ff45361e9469e85c0f86b8e7b82c63e50bab8ef, 5e9a94539b1ec17a89177d952badfd0d844d694a, and f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a. Consult your Linux distribution's security tracker for backported package versions.
Workarounds
- If patching is not immediately possible, disable the gssproxy service on hosts that do not require RPCSEC_GSS authentication
- Restrict NFS and RPCSEC_GSS exposure to trusted network segments to reduce the reachable attack surface
- Enforce memory resource limits and monitoring to detect the allocation-failure conditions that precede the NULL dereference
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
