CVE-2026-89538

A flaw was found in the Linux kernel's Server Unix Remote Procedure Call (SUNRPC) component. A remote attacker, with a valid Generic Security Service (GSS) context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" (ec) field. This improper handling of malformed tokens could lead to the buffer being left in a semantically invalid state, potentially causing a denial of service or other unpredictable behavior within the system.

SUNRPC GSS krb5 v2 unwrap accepts authenticated wrap tokens where the encrypted ec field is larger than the remaining wrapped payload segment. A peer that already holds a valid GSS context can send such a malformed token and force xdr_buf_trim to trim past the wrapped blob boundary, leaving the xdr_buf in an invalid logical state with zero length or inconsistent iov lengths. For the CVSS the PR:L is used because the attacker needs a valid RPCSEC_GSS authentication context but does not need local privileges on the victim. The issue is network reachable through SUNRPC services that use Kerberos privacy or integrity wrapping, such as NFS with krb5i or krb5p. Impact is primarily denial of service or request processing disruption. A direct privilege escalation primitive is not evident from the patch, but the network reachable parser state issue should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.