CVE-2026-89541

A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the gss_unwrap_resp_priv() function within the SUNRPC component. This flaw occurs when validating the length of RPCSEC_GSS opaque data. A malicious krb5p Network File System (NFS) server can send a specially crafted RPCSEC_GSS reply, leading to an out-of-bounds read. This could potentially result in information disclosure or a denial of service (DoS) on the client system.

A length validation flaw in the SUNRPC RPCSEC_GSS client privacy unwrap path can allow a crafted server reply to bypass bounds checks. The vulnerable check used offset plus opaque_len with u32 arithmetic, so a very large opaque_len can wrap the computed end offset and make gss_unwrap operate on an invalid range. A too short opaque_len can also pass into the Kerberos unwrap code and cause out of bounds reads while parsing the token header or during later buffer rotation. For the CVSS the PR:N value is used because the attacker does not need an account or code execution on the client and can act through a malicious or compromised NFS server endpoint. The issue is network reachable in deployments where an NFS client uses RPCSEC_GSS privacy mode such as krb5p against an attacker controlled or compromised server. Impact is at least denial of service via kernel crash and may include limited confidentiality exposure from out of bounds reads. Integrity impact is kept limited in the paranoid score because no clear arbitrary write primitive is shown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.