CVE-2026-91926: gss-ntlmssp Memory Leak DoS Vulnerability

CVE-2026-91926 Overview

CVE-2026-91926 is a memory leak vulnerability in gss-ntlmssp, an open-source GSSAPI mechanism implementing NTLM authentication used on Linux systems. The flaw resides in the NTLM target-info parser, which processes AV_PAIR entries within NTLM CHALLENGE messages. When a crafted CHALLENGE message contains duplicated string-valued AV_PAIR entries, the parser allocates memory for each value without freeing prior allocations of the same type. A malicious or man-in-the-middle server can send repeated authentication challenges to gradually exhaust client memory, resulting in denial of service. The weakness is tracked as [CWE-401] Missing Release of Memory After Effective Lifetime.

Critical Impact
A remote server can trigger gradual memory exhaustion on gss-ntlmssp clients during NTLM authentication, degrading availability of dependent services.

Affected Products

gss-ntlmssp GSSAPI NTLM mechanism library
Red Hat Enterprise Linux distributions bundling gss-ntlmssp (per Red Hat advisory)
Applications and services using gss-ntlmssp for client-side NTLM authentication

Discovery Timeline

2026-09-15 - CVE-2026-91926 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91926

Vulnerability Analysis

The NTLM authentication exchange uses a CHALLENGE_MESSAGE sent from server to client. That message includes a TargetInfo field composed of a sequence of AV_PAIR structures. Each AV_PAIR has a type identifier and a value, where several types carry string values such as the NetBIOS computer name, DNS domain name, and target name.

The gss-ntlmssp parser iterates through the AV_PAIR list and allocates memory for each string value it decodes. When two or more pairs share the same string-valued type, the parser overwrites the destination pointer with a new allocation without releasing the previous one. The earlier allocation becomes unreachable and leaks for the lifetime of the process.

Exploitation requires a client to initiate NTLM authentication against an attacker-controlled or intercepted server. Each authentication attempt can leak multiple allocations. Repeated attempts against long-running clients cause cumulative memory growth that eventually degrades or halts service.

Root Cause

The root cause is a missing free operation in the target-info parsing loop. The code assumes each AV_PAIR type appears at most once and therefore does not check whether the destination field has been assigned before overwriting it.

Attack Vector

The attack vector is network-based and unauthenticated. An adversary controlling or proxying an SMB, HTTP, LDAP, or other NTLM-negotiating server crafts a CHALLENGE message with duplicated string AV_PAIR entries, then forces repeated authentication attempts from the client.

No verified public exploit code is available for CVE-2026-91926. Refer to the Red Hat CVE-2026-91926 Advisory and Red Hat Bug Report #2533698 for technical details.

Detection Methods for CVE-2026-91926

Indicators of Compromise

Sustained memory growth (RSS) in processes linked against libgssapi using the gss-ntlmssp mechanism, correlated with NTLM authentication activity.
NTLM CHALLENGE messages containing duplicate AV_PAIR type identifiers observed on the wire.
Repeated NTLM handshakes originating from a single client toward an unexpected or newly observed server.

Detection Strategies

Inspect SMB, HTTP, and LDAP traffic for NTLMSSP CHALLENGE messages containing duplicate MsvAvNbComputerName, MsvAvDnsDomainName, or MsvAvTargetName entries.
Baseline memory usage of NTLM client processes and alert on abnormal linear growth over hours or days.
Correlate outbound NTLM authentication to untrusted external hosts using proxy and network telemetry.

Monitoring Recommendations

Ingest process memory, NTLM authentication, and network flow telemetry into a centralized data lake for cross-source correlation.
Alert when NTLM negotiations target servers outside the enterprise identity perimeter.
Track service restart frequency for daemons that perform outbound NTLM, as unexplained restarts may indicate exhaustion.

How to Mitigate CVE-2026-91926

Immediate Actions Required

Apply updated gss-ntlmssp packages from your Linux distribution once available; monitor the Red Hat CVE-2026-91926 Advisory for fixed versions.
Inventory hosts and applications that link against gss-ntlmssp and prioritize patching for long-running services.
Restrict outbound NTLM authentication to trusted internal servers using host and network firewalls.

Patch Information

Red Hat has published tracking under Bug Report #2533698. Consult your distribution's package repository for the fixed gss-ntlmssp build addressing the missing free in the target-info parser.

Workarounds

Prefer Kerberos over NTLM where possible by adjusting GSSAPI mechanism preferences in application configuration.
Terminate outbound NTLM sessions at an authenticated proxy that validates CHALLENGE message structure.
Configure service supervisors to enforce memory limits and automatic restart for processes performing NTLM authentication until patches are deployed.

bash

# Example: constrain a systemd-managed service to bound memory exposure
# /etc/systemd/system/<service>.service.d/override.conf
[Service]
MemoryMax=512M
Restart=on-failure
RestartSec=5s