CVE-2026-89551

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by

walking the tail, pages, and head iovecs. Each per-section step

uses min_t() so it never removes more bytes than that section

holds, but the final accounting at the fix_len label subtracts the

total bytes actually consumed from buf->len without any clamp:

fix_len:

buf->len -= (len - trim);

When the caller has set buf->len to a value smaller than the sum

of the iov_lens, (len - trim) can exceed buf->len and the unsigned

subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches

xdr_buf_trim() in exactly that state:

buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;

buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);

xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);

buf->len is a small wire-derived value while the iov_lens are at

page scale, so the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References