CVE-2026-89538

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

gss_krb5_unwrap_v2() sets buf->len to a logical

length, which can be much smaller than head[0].iov_len

(the allocated receive-page capacity). It then calls

xdr_buf_trim() with a trim length derived from the 16-bit

"extra count" (ec) field in the Kerberos v2 token header.

The ec field is authenticated by the post-decrypt memcmp()

against the encrypted header copy, so a randomly-mutated

value is rejected. However, any peer holding a valid GSS

context can legitimately encrypt a token whose ec exceeds

the plaintext length. Per RFC 4121, such a token is

structurally malformed.

Although xdr_buf_trim() now clamps the buf->len subtraction

to avoid unsigned underflow, the buffer is still left in a

semantically invalid state (zero length, inconsistent iov

lengths) when ec is oversized.

Reject these tokens before calling xdr_buf_trim(), giving

callers a well-defin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References