CVE-2026-89551: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89551 Overview

CVE-2026-89551 is an integer underflow vulnerability in the Linux kernel's SUNRPC subsystem, specifically in the xdr_buf_trim() function. The flaw allows an unsigned subtraction to wrap to near UINT_MAX when buf->len is smaller than the total bytes consumed across the tail, pages, and head iovecs. The wrapped length then propagates as the authoritative stream bound into every downstream XDR decoder. The gss_krb5_unwrap_v2() code path reaches xdr_buf_trim() in exactly this vulnerable state, making Kerberos-authenticated NFS traffic a realistic trigger.

Critical Impact
A remote, unauthenticated attacker can trigger an integer underflow in kernel XDR parsing over the network, potentially corrupting downstream decoder state across the SUNRPC stack.

Affected Products

Linux kernel SUNRPC subsystem (net/sunrpc/xdr.c)
Kerberos GSS integrity module (gss_krb5_unwrap_v2())
Linux distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-09-11 - CVE-2026-89551 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89551

Vulnerability Analysis

The xdr_buf_trim() helper removes len bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs in sequence. Each per-section step uses min_t() to cap what it consumes from that section. The bug lives in the final accounting at the fix_len label, which subtracts the total bytes actually consumed from buf->len without any clamp: buf->len -= (len - trim);.

When a caller has set buf->len to a value smaller than the sum of the iov_lens, the expression (len - trim) can exceed buf->len. Because buf->len is an unsigned integer, the subtraction wraps to a value close to UINT_MAX. Every downstream XDR decoder then reads this wrapped length as the authoritative stream bound.

Root Cause

The root cause is a missing bounds check on an unsigned arithmetic operation, classified as an integer underflow. The function trusts that buf->len is consistent with the aggregate of the iov_lens, but the Kerberos unwrap path deliberately shrinks buf->len to a small wire-derived value while leaving the iov_lens at page scale. The per-section loops then legitimately consume far more bytes than buf->len records, and the final decrement underflows.

Attack Vector

An attacker who can send crafted RPC traffic to a vulnerable host, particularly over Kerberos-protected NFS mounts using gss_krb5_unwrap_v2(), can drive buf->len into the underflow state. Since the wrapped length propagates to downstream XDR decoders, attackers can influence how much data those decoders treat as valid. The upstream fix clamps the decrement using buf->len -= min_t(unsigned int, buf->len, len - trim);, ensuring buf->len bottoms out at zero. On the normal path where iov_lens sum to buf->len, the result is identical to the previous behavior.

See the upstream kernel commit for the exact patch and stable backports.

Detection Methods for CVE-2026-89551

Indicators of Compromise

Unexpected kernel warnings, oopses, or panics originating from the SUNRPC or NFS client stack after processing RPC replies.
Sudden termination of nfsd, rpc.gssd, or NFS client threads following Kerberos-authenticated traffic.
Anomalous or malformed RPC responses to NFS clients using sec=krb5i or sec=krb5p mount options.

Detection Strategies

Inventory hosts running Linux stable kernels prior to the fix commits listed in the NVD references and correlate with NFS/Kerberos usage.
Enable kernel address sanitizers (KASAN) or UBSAN in test environments to surface the unsigned wrap during RPC replay tests.
Alert on repeated SUNRPC or rpcsec_gss error counters in /proc/net/rpc/ that coincide with client crashes.

Monitoring Recommendations

Ship kernel logs and NFS server telemetry to a centralized analytics platform for correlation across hosts.
Monitor for unauthenticated inbound RPC connections on ports 111/2049 from untrusted network segments.
Track patch state of the kernel package across the fleet and flag any host still running a pre-fix build.

How to Mitigate CVE-2026-89551

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the xdr_buf_trim() clamp fix as soon as it becomes available for your distribution.
Restrict network exposure of NFS and other SUNRPC services to trusted management VLANs until patched.
Prioritize patching NFS servers and clients configured with sec=krb5, sec=krb5i, or sec=krb5p, since gss_krb5_unwrap_v2() is the confirmed trigger path.

Patch Information

The fix has been merged into the mainline Linux kernel and backported to multiple stable branches. Reference commits include 3f491306, 4bf59cb0, 85e96026, a3d77bcd, a924ac4c, ad0cce80, e6267ccc, and fa16bbe9. Distribution vendors are shipping equivalent errata kernels; consult your vendor advisory for exact package versions.

Workarounds

Disable Kerberos-authenticated NFS mounts (sec=krb5*) on hosts where they are not strictly required, favoring sec=sys on isolated management networks only.
Block RPC ports at perimeter firewalls and enforce network segmentation for storage traffic.
Where feasible, unload the rpcsec_gss_krb5 kernel module on systems that do not require GSS-Kerberos RPC.

bash

# Verify running kernel and check for the fix
uname -r

# Inspect current NFS mount security flavors
mount -t nfs4 | grep -E 'sec=krb5'

# Temporarily remount without Kerberos where policy allows
mount -o remount,sec=sys /mnt/nfs_share

# Restrict SUNRPC/NFS exposure at the host firewall
nft add rule inet filter input tcp dport {111,2049} ip saddr != 10.0.0.0/24 drop