CVE-2026-89537

CVE-2026-89537 is an out-of-bounds read in the Linux kernel 's SUNRPC subsystem, specifically in gss_krb5_verify_mic_v2() . The function reads the token ID, flags byte, and padding from a GSS-KRB5 MIC token without first checking read_token->len against the minimum safe size of GSS_KRB5_TOK_HD...