CVE-2026-89538

CVE-2026-89538 affects the Linux kernel SUNRPC subsystem. The vulnerability resides in gss_krb5_unwrap_v2() , where a peer holding a valid GSS context can encrypt a Kerberos v2 wrap token whose 16-bit "extra count" (ec) field exceeds the plaintext length. Although a prior fix clamped the subtract...