CVE-2026-89544

A flaw was found in the Linux kernel's SUNRPC component. Multiple defects in the gssx_dec_option_array XDR option-array decoder's error handling can lead to a NULL dereference, a reference count leak, and a use-after-free vulnerability. An attacker could potentially exploit these issues by providing specially crafted input, leading to a system crash (denial of service) or other memory corruption.

Red Hat Enterprise Linux 8, 9, and 10 (including the kernel-rt real-time variants and the RHEL CoreOS 9 kernels shipped with OpenShift 4 and OpenShift 5) and the Red Hat in-vehicle operating system (RHIVOS) are affected by a moderate-severity flaw in the Linux kernel's SUNRPC gss-proxy XDR decoding path. Coupled defects in the error handling of gssx_dec_option_array() can cause a NULL pointer dereference in gssp_accept_sec_context_upcall(), a reference-count leak of a decoded group_info object, and a latent use-after-free during credential teardown. An attacker who can influence replies from the local gssproxy service, or who can induce memory-allocation failures on a system using SUNRPC GSS, could trigger these paths to crash the kernel, resulting in a denial of service, with potential memory corruption via the use-after-free path. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L) rather than the upstream CVEORG score of 7.5 (AV:N) because the vulnerable decoder processes replies to the kernel's local gss-proxy upcalls rather than being directly network-reachable in the way a remote protocol parser flaw would be. RHEL 6, RHEL 7, and older RHEL 8 and RHEL 9 update streams are not affected, because the vulnerable code only entered RHEL through later backports of the upstream gssx option-array memory-leak fixes. For the affected products, the fix has been deferred to a future update; the residual risk is limited to denial of service through error paths that require malformed gss-proxy replies or allocation failures, which limits practical exploitability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.