{"id":"CVE-2026-89550","title":"SUNRPC: svcauth_gss: enforce krb5 token minimum length","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: svcauth_gss: enforce krb5 token minimum length\n\nsvcauth_gss_unwrap_priv() validates only an upper bound on the\nwire-supplied opaque length before handing the bu…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < 0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd","Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < dd6afc6cab8c5d387d1ed2f069562ef7bdadd651","Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < de942dd8c2c8358bcad04ce44271954c48924423","Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < 2eed1e6a976a44015c3ee78841fe336796e2b21c","Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < a919c5c88769cf8fb3ec071e6078d830bf512489","Linux 2.6.18"],"published":"2026-09-11","updated":"2026-09-14","sourceUpdated":"2026-09-14T12:00:53.633Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89550","references":[{"url":"https://git.kernel.org/stable/c/0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd"},{"url":"https://git.kernel.org/stable/c/dd6afc6cab8c5d387d1ed2f069562ef7bdadd651"},{"url":"https://git.kernel.org/stable/c/de942dd8c2c8358bcad04ce44271954c48924423"},{"url":"https://git.kernel.org/stable/c/2eed1e6a976a44015c3ee78841fe336796e2b21c"},{"url":"https://git.kernel.org/stable/c/a919c5c88769cf8fb3ec071e6078d830bf512489"}],"tags":["cve.org"],"epss":0.00463,"epssPercentile":0.39379,"ingestedAt":"2026-09-14T15:23:07.452Z","slug":"CVE-2026-89550","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: svcauth_gss: enforce krb5 token minimum length\n\nsvcauth_gss_unwrap_priv() validates only an upper bound on the\nwire-supplied opaque length before handing the buffer to\ngss_unwrap():\n\n    if (len > xdr_stream_remaining(xdr))\n            goto unwrap_failed;\n    offset = xdr_stream_pos(xdr);\n    ...\n    maj_stat = gss_unwrap(ctx, offset, offset + len, buf);\n\nThe wire value `len` flows unchanged as the upper bound into the\nkrb5 unwrap path, so a len in [0, 16] passes this check and is\nhanded to gss_unwrap(). For a krb5 v2 context that lands in\ngss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token\nheader fields at ptr+4 and ptr+6 and then calls rotate_left()\nbefore any integrity check. With a sub-header length the header\nreads run past the token, and _rotate_left()'s `shift %= buf->len`\npath can divide by zero when buf->len has been driven to zero by\nthe truncated token. A header-only token (len == 16) is equally\ninvalid: with a non-zero RRC field and the opaque blob ending at\nthe XDR buffer boundary, rotate_left() builds a zero-length\nsubbuffer, reaching the same division.\n\nReject the token at the server entry point before it reaches the\nkrb5 unwrap core. A valid sealed RFC 4121 token must contain\nthe 16-byte header plus at least some encrypted payload.\n\nFix by adding a minimum-length check immediately after the\nexisting upper-bound check:\n\n    if (len <= GSS_KRB5_TOK_HDR_LEN)\n            goto unwrap_failed;\n\n## Affected\n\n- `Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < 0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd`\n- `Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < dd6afc6cab8c5d387d1ed2f069562ef7bdadd651`\n- `Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < de942dd8c2c8358bcad04ce44271954c48924423`\n- `Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < 2eed1e6a976a44015c3ee78841fe336796e2b21c`\n- `Linux >= 7c9fdcfb1b64c47ed618c103b617af3f86e1239c < a919c5c88769cf8fb3ec071e6078d830bf512489`\n- `Linux 2.6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":197933,"id":"CVE-2026-89550","ts":1789384321023,"field":"cvss","old":"5.9","new":"9.8"},{"seq":197932,"id":"CVE-2026-89550","ts":1789384321023,"field":"severity","old":"medium","new":"critical"},{"seq":183754,"id":"CVE-2026-89550","ts":1789356677248,"field":"cvss","old":"9.8","new":"5.9"},{"seq":183753,"id":"CVE-2026-89550","ts":1789356677248,"field":"severity","old":"critical","new":"medium"},{"seq":153356,"id":"CVE-2026-89550","ts":1789285350179,"field":"cvss","old":null,"new":"9.8"},{"seq":153355,"id":"CVE-2026-89550","ts":1789285350179,"field":"severity","old":"none","new":"critical"},{"seq":147770,"id":"CVE-2026-89550","ts":1789270212222,"field":"cvss","old":null,"new":"5.9"},{"seq":147769,"id":"CVE-2026-89550","ts":1789270212222,"field":"severity","old":"none","new":"medium"},{"seq":109524,"id":"CVE-2026-89550","ts":1789183732278,"field":"cvss","old":null,"new":"5.9"},{"seq":109523,"id":"CVE-2026-89550","ts":1789183732278,"field":"severity","old":"none","new":"medium"}]}