CVE-2026-45870

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths

The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name()

functions allocate memory via gssx_dec_buffer(), which calls

kmemdup(). When a subsequent decode operation fails, these

functions return immediately without freeing previously

allocated buffers, causing memory leaks.

The leak in gssx_dec_ctx() is particularly relevant because

the caller (gssp_accept_sec_context_upcall) initializes several

buffer length fields to non-zero values, resulting in memory

allocation:

struct gssx_ctx rctxh = {

.exported_context_token.len = GSSX_max_output_handle_sz,

.mech.len = GSS_OID_MAX_LEN,

.src_name.display_name.len = GSSX_max_princ_sz,

.targ_name.display_name.len = GSSX_max_princ_sz

};

If, for example, gssx_dec_name() succeeds for src_name but

fails for targ_name, the memory allocated for

exported_context_token, mech, and s

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References