CVE-2026-89551

A flaw was found in the Linux kernel's SUNRPC subsystem, specifically within the xdr_buf_trim() function. This vulnerability occurs when xdr_buf_trim() attempts to reduce the size of an XDR buffer. If the buffer's length is smaller than the amount being trimmed, an integer underflow can occur, causing the buffer's length to wrap to a very large value. This corrupted length then propagates to other XDR decoders, potentially leading to data misinterpretation and unexpected system behavior.

SUNRPC xdr_buf_trim can underflow buf len when the recorded XDR buffer length is smaller than the amount consumed from the tail pages and head iovecs. In the gss_krb5_unwrap_v2 path this can be reached from a crafted RPCSEC_GSS Kerberos protected buffer where buf len is a small wire derived value while the backing iovec lengths are larger. The wrapped length then becomes an oversized authoritative stream bound for downstream XDR decoders, which may allow parsing or reads beyond the intended authenticated payload and can lead to denial of service or stronger confidentiality and integrity impact. For the CVSS the PR:L is used because reliable triggering normally requires a valid RPCSEC_GSS security context or control of a trusted RPC peer rather than only sending unauthenticated traffic. The issue is network reachable in deployments using SUNRPC with Kerberos security, commonly NFS environments on internal storage or data center networks. Impact is at least network triggered denial of service and in worst case may allow confidentiality or integrity impact due to incorrect XDR bounds handling.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.