CVE-2026-89550: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89550 Overview

CVE-2026-89550 is a Linux kernel vulnerability in the SUNRPC server-side GSS authentication path. The flaw lives in svcauth_gss_unwrap_priv(), which validates only an upper bound on the wire-supplied opaque length before invoking gss_unwrap(). A truncated Kerberos v2 token with a length in the [0, 16] range reaches gss_krb5_unwrap_v2(), where header fields are read past the token boundary and rotate_left() performs a modulo operation on a zero-length buffer. The resulting divide-by-zero crashes the kernel and denies service to all NFS clients using RPCSEC_GSS.

Critical Impact
A remote, unauthenticated attacker can send a malformed RPCSEC_GSS packet to trigger a kernel divide-by-zero, causing denial of service on NFS servers and other SUNRPC consumers.

Affected Products

Linux kernel builds containing the vulnerable svcauth_gss_unwrap_priv() implementation
SUNRPC server-side stack with RPCSEC_GSS (Kerberos v5) enabled
NFS servers exporting shares protected by sec=krb5p

Discovery Timeline

2026-09-11 - CVE-2026-89550 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89550

Vulnerability Analysis

The vulnerability affects the server-side GSS-API privacy unwrap path in the Linux kernel's SUNRPC subsystem. svcauth_gss_unwrap_priv() checks that the wire-supplied opaque length does not exceed the remaining XDR stream, but performs no minimum-length validation. The unchecked length flows into gss_unwrap() and reaches gss_krb5_unwrap_v2(), which assumes at least a 16-byte RFC 4121 token header is present. When the length is [0, 16], the header reads at ptr+4 and ptr+6 run past the token, and rotate_left() executes shift %= buf->len on a buffer whose length has been driven to zero. A header-only token with len == 16 and a non-zero RRC field produces a zero-length subbuffer that reaches the same modulo-by-zero. The result is a kernel oops on the server processing the request.

Root Cause

The root cause is missing input validation on an attacker-controlled length field before it is consumed by cryptographic unwrap logic. The correct minimum invariant, a sealed RFC 4121 token must contain the 16-byte header plus at least one byte of encrypted payload, was not enforced at the server entry point. This is an Improper Input Validation flaw that manifests as a Denial of Service through a divide-by-zero in rotate_left().

Attack Vector

Exploitation is network-reachable and does not require authentication, because the malformed token is processed inside the authentication path itself. An attacker sends a crafted RPC call to a service that accepts RPCSEC_GSS with Kerberos v5 privacy (krb5p), such as an NFS server. The RPC contains a GSS wrap token whose opaque length is between 0 and 16 bytes. The server passes the truncated buffer to gss_krb5_unwrap_v2(), triggering the divide-by-zero and crashing the kernel thread handling the request. Repeated requests keep the service unavailable.

The upstream fix adds a minimum-length check immediately after the existing upper-bound check in svcauth_gss_unwrap_priv(): tokens with len <= GSS_KRB5_TOK_HDR_LEN are rejected before reaching the krb5 unwrap core. See the kernel commit for the corrective patch.

Detection Methods for CVE-2026-89550

Indicators of Compromise

Kernel oops or panic messages referencing rotate_left, gss_krb5_unwrap_v2, or svcauth_gss_unwrap_priv in dmesg or /var/log/messages.
Divide-by-zero exceptions logged by the kernel on hosts exporting NFS with sec=krb5p.
Unexpected nfsd thread crashes or SUNRPC service restarts correlated with inbound RPC traffic.

Detection Strategies

Monitor kernel ring buffer for divide error and stack traces originating in the SUNRPC GSS unwrap path.
Inspect network telemetry for RPCSEC_GSS wrap tokens with abnormally small opaque length fields (<= 16 bytes).
Correlate NFS client disconnects and server reboots with recent RPC authentication traffic from untrusted sources.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized log store and alert on svcauth_gss or gss_krb5 stack frames.
Track nfsd service uptime and restart counts as a stability signal.
Restrict and audit sources permitted to reach TCP/UDP port 2049 and portmapper (111) on Kerberized NFS servers.

How to Mitigate CVE-2026-89550

Immediate Actions Required

Apply the upstream Linux kernel patch that adds the len <= GSS_KRB5_TOK_HDR_LEN rejection in svcauth_gss_unwrap_priv() and reboot affected servers.
Restrict network access to NFS and other RPCSEC_GSS services to trusted client subnets using host or perimeter firewalls.
Prioritize patching internet-exposed or multi-tenant NFS servers configured with sec=krb5p.

Patch Information

The fix is available in the stable Linux kernel tree across multiple maintained branches. Refer to the following commits: commit 1, commit 2, commit 3, commit 4, and commit 5. Deploy the vendor-backported kernel appropriate to your distribution.

Workarounds

Where feasible, disable RPCSEC_GSS privacy (krb5p) exports until the kernel is patched, and use sec=sys or sec=krb5i only on isolated networks.
Enforce iptables or nftables rules that limit inbound access to nfsd and rpcbind from known client addresses.
Segment Kerberized NFS servers on management networks that are not reachable by untrusted endpoints.

bash

# Example nftables rule limiting NFS access to a trusted subnet
nft add rule inet filter input ip saddr != 10.0.0.0/24 tcp dport {111, 2049} drop
nft add rule inet filter input ip saddr != 10.0.0.0/24 udp dport {111, 2049} drop