CVE-2026-89544

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: fix gssx_dec_option_array error path bugs

Four coupled defects in the gssx XDR option-array decoder make the

error paths unsafe: a NULL deref in the caller, a refcount leak on

the decoded group_info, and a latent use-after-free that the leak

fix would otherwise expose.

gssx_dec_option_array() sets oa->count = 1 before allocating

oa->data. If that allocation fails, -ENOMEM is returned with

oa->count == 1 and oa->data == NULL. All other error paths jump

to free_oa: which frees oa->data and NULLs it but also leaves

oa->count == 1. The caller trusts the count:

gssp_accept_sec_context_upcall()

gssx_dec_accept_sec_context()

gssx_dec_option_array() /* fails, count=1 data=NULL */

data = res.options.data[0].value /* NULL deref */

Independently, free_creds: releases the partially decoded svc_cred

with a bare kfree(creds). gssx_dec_linux_creds() installs a

groups_alloc() result into

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References