CVE-2026-89550

A flaw was found in the Linux kernel's SUNRPC svcauth_gss module. A remote attacker could send a specially crafted Kerberos (krb5) token with an insufficient length. This could lead to a division-by-zero error within the gss_krb5_unwrap_v2() function, resulting in a Denial of Service (DoS) for the affected system.

A minimum length validation bug in SUNRPC svcauth_gss_unwrap_priv can pass a too short krb5 privacy token into gss_unwrap() and gss_krb5_unwrap_v2(). The krb5 unwrap path expects the RFC 4121 token header and may read past the supplied token before integrity verification, then rotate_left() can reach a zero length buffer and divide by zero. For the CVSS the PR:L is used because practical triggering normally requires a usable RPCSEC_GSS krb5 context or authenticated access to the NFS/RPC security flavor, not local privileges on the victim host. The issue is network reachable when an NFS server exposes RPCSEC_GSS privacy to untrusted clients. Impact is at least remote denial of service via kernel crash. The paranoid score adds C:L because the patch context shows an invalid read past the supplied token, but there is no clear arbitrary write or UAF primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.