CVE-2026-89537

A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the gss_krb5_verify_mic_v2 function. A remote malicious Network File System (NFS) server could provide a specially crafted, short Kerberos Message Integrity Code (MIC) token. This could lead to the kernel reading past an allocated memory buffer, potentially causing a denial of service or information disclosure.

A short RFC 4121 MIC token can reach gss_krb5_verify_mic_v2 without the minimum length needed for the token header and Kerberos checksum. The verifier reads token header bytes and later builds checksum input from memory beyond the supplied token when read_token len is too small, which creates an out-of-bounds kernel read. A malicious RPCSEC_GSS peer can trigger this over the network, including a malicious NFS server replying to a client or a malicious client reaching server side GSS verification paths. For the CVSS the PR:N is used because the attacker does not need a local account or local code execution on the victim and only needs a reachable authenticated or negotiated RPCSEC_GSS protocol position. Impact is at least remote denial of service via kernel crash. In the paranoid score, limited confidentiality impact is kept because the primitive is an out-of-bounds read, but integrity impact is not raised because the patch does not indicate an overwrite or UAF write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.