Linux Distros Unpatched Vulnerability : CVE-2026-89537

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7,...

Linux Distros Unpatched Vulnerability : CVE-2026-89544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller...

Linux Distros Unpatched Vulnerability : CVE-2026-89539

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls...

Linux Distros Unpatched Vulnerability : CVE-2026-89538

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gsskrb5unwrapv2 sets buf-len to a logical length, which can be much smaller than head0.iovlen the...

CVE-2026-89548

A flaw was found in the Linux kernel's SUNRPC component. When sunrpcdestroycachedetail is called, it may not properly drain the cachecleaner before freeing a cachedetail object. This oversight can lead to a use-after-free vulnerability, where the system attempts to access or use memory that has...

CVE-2026-89549

A flaw was found in the sunrpc component of the Linux kernel. When the nfsd service runs with fewer threads than available pools, a transport can be routed to a pool with no active threads. This prevents the connection from being processed, causing it to hang indefinitely. This can lead to a Deni...

CVE-2026-89551

A flaw was found in the Linux kernel's SUNRPC subsystem, specifically within the xdrbuftrim function. This vulnerability occurs when xdrbuftrim attempts to reduce the size of an XDR buffer. If the buffer's length is smaller than the amount being trimmed, an integer underflow can occur, causing th...

CVE-2026-89536

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call client TLS Transport Layer Security handshake process. A race condition exists where a reference to the lower transport can be prematurely released during handshake cancellation. This can lead to memory corruption, potentiall...

CVE-2026-89542

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call implementation. This vulnerability, located in the gsskrb5unwrapv2 function, arises when the system processes specially crafted short tokens or tokens with an invalid length. An attacker could exploit this by providing such a...

CVE-2026-89541

A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the gssunwrapresppriv function within the SUNRPC component. This flaw occurs when validating the length of RPCSECGSS opaque data. A malicious krb5p Network File System NFS server can send a specially...

CVE-2026-89546

A flaw was found in the Linux kernel's SUNRPC Sun Remote Procedure Call Network File System NFS callback service. A race condition during the service teardown can lead to system resources not being properly released, causing a resource leak. This issue could also result in a use-after-free...

CVE-2026-89545

A flaw was found in the Linux kernel. This vulnerability exists within the sunrpc component, where memory associated with rqargp and rqresp is freed prematurely. Specifically, the svcrqstfree function frees these structures synchronously, while the main request structure rqstp is freed later via...

CVE-2026-89540

A flaw was found in the Linux kernel's sunrpc component. A race condition exists where the gssplock mutex is not initialized before its associated /proc/net/rpc/use-gss-proxy entry is published. This allows a local attacker to trigger a scenario where multiple writers can concurrently access the...

CVE-2026-89550

A flaw was found in the Linux kernel's SUNRPC svcauthgss module. A remote attacker could send a specially crafted Kerberos krb5 token with an insufficient length. This could lead to a division-by-zero error within the gsskrb5unwrapv2 function, resulting in a Denial of Service DoS for the affected...

CVE-2026-89538

A flaw was found in the Linux kernel's Server Unix Remote Procedure Call SUNRPC component. A remote attacker, with a valid Generic Security Service GSS context, could send a specially crafted Kerberos v2 wrap token with an oversized "extra count" ec field. This improper handling of malformed toke...

CVE-2026-89537

A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the gsskrb5verifymicv2 function. A remote malicious Network File System NFS server could provide a specially crafted, short Kerberos Message Integrity Code MIC token. This could lead to the kernel reading past an...

CVE-2026-89547

A flaw was found in the Linux kernel's SUNRPC component. A local administrator, under specific conditions of memory pressure or fault injection during RPC server startup, can trigger a failure in per-CPU counter allocation. This failure leads to uninitialized counters, which, when subsequently...

CVE-2026-89544

A flaw was found in the Linux kernel's SUNRPC component. Multiple defects in the gssxdecoptionarray XDR option-array decoder's error handling can lead to a NULL dereference, a reference count leak, and a use-after-free vulnerability. An attacker could potentially exploit these issues by providing...

CVE-2026-89543

A flaw was found in the kernel's sunrpc component. A use-after-free vulnerability can occur due to improper handling of clnt-pipefssb pointers during mount and unmount events. This can lead to stale pointers, which, when accessed, may result in a system crash Denial of Service...

DEBIAN-CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...