CVE-2026-89537

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags

byte at ptr[2], and padding at ptr[3..7], then passes

ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().

None of these accesses check read_token->len first.

The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus

ctx->krb5e->cksum_len (12-24, depending on the enctype). All callers

accept shorter tokens from the wire:

- gss_unwrap_resp_integ() enforces only an upper bound

(offset + len <= rcv_buf->len) before allocating

mic.data = kmalloc(len) and passing it to gss_verify_mic().

A malicious NFS server can therefore supply a short checksum

opaque, producing a small slab allocation that the Kerberos MIC

verifier reads past.

- gss_validate() enforces only len <= RPC_MAX_AUTH_SIZE (400)

before passing the wire-supplied length to

gss_valida

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References