CVE-2026-89784 SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89784

CVE-2026-89784 affects the Linux kernel SUNRPC subsystem. The functions rpcb_register_inet4() and rpcb_register_inet6() store the result of rpc_sockaddr2uaddr() into map->r_addr without checking for NULL . When the final kstrdup() inside rpc_sockaddr2uaddr() fails under memory pressure , the u...

EUVD-2026-80305

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

CVE-2026-89784 SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

SUSE CVE-2026-89541

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

SUSE CVE-2026-89546

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchannel receive can complete a request while the NFS callback service is being torn down. xprtcompletebcrequest removes the request from bcpalist, drops...

CVE-2026-89784: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpcsockaddr2uaddr return value in rpcbregisterinet4/6 rpcbregisterinet4 and rpcbregisterinet6 store the result of rpcsockaddr2uaddr into map-raddr without checking it for NULL. rpcsockaddr2uaddr returns NULL when it...

PT-2026-93390

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12 Description In the SUNRPC component, the functions rpcb register inet4 and rpcb register inet6 fail to check the return value of rpc sockaddr2uaddr before storing it in map-r addr. When rpc sockaddr2uaddr returns NULL...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcpwritetimerhandler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not...

Astra Linux – Vulnerability in glibc

The deprecated compatibility function clntcreate in the sunrpc module of the GNU C Library also known as glibc from versions up to 2.34 copies its hostname argument onto the stack without validating its length. This may lead to a buffer overflow, potentially causing a denial of service or, if the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: sunrpc: Fix for the cacherequest leak in cacherelease. When a reader’s file descriptor is closed while the cacherequest is still being read i.e., when rp-offset != 0, cacherelease decrements the number of readers for the request,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: SUNRPC: Fixed null-ptr-deref when xps sysfs alloc fails There is a null-ptr-deref when xps sysfs alloc fails: BUG: KASAN: null-ptr-deref in sysfsdocreatelinksd+0x40/0xd0 Reading a 8-byte value at address 0000000000000030 by ta...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Trap RDMA segment overflows This fix prevents svcrdmabuildwrites from exceeding the end of a Write chunk’s segment array. This issue was identified using KASAN. The test that this fix replaces is invalid; it may have...

SUSE CVE-2026-89536

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

SUSE CVE-2026-89537

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSSKRB5TOKHDRLEN and cksumlen to gsskrb5micbuildsg...

SUSE CVE-2026-89538

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gsskrb5unwrapv2 sets buf-len to a logical length, which can be much smaller than head0.iovlen the allocated receive-page capacity. It then calls xdrbuftrim with a trim...

SUSE CVE-2026-89539

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...

SUSE CVE-2026-89540

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssplock before publishing proc entry createusegssproxyprocentry publishes /proc/net/rpc/use-gss-proxy via proccreatedata before initgsspclnt runs mutexinit on sn-gssplock. Once the dentry is linked under...

SUSE CVE-2026-89542

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...

SUSE CVE-2026-89543

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpcclnthandleevent and rpcclntremovepipedir Normal client creation goes through rpcsetuppipedir, which records clnt-pipefssb, but the mount-event path in rpcclnthandleevent calls rpcsetuppipedirsb...