CVE-2026-89537 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSSKRB5TOKHDRLEN and cksumlen to gsskrb5micbuildsg...

CVE-2026-89538 SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gsskrb5unwrapv2 sets buf-len to a logical length, which can be much smaller than head0.iovlen the allocated receive-page capacity. It then calls xdrbuftrim with a trim...

CVE-2026-89538

CVE-2026-89538 affects the Linux kernel's SUNRPC component, specifically the gss_krb5_unwrap_v2() function. A remote peer holding a valid GSS context can send a Kerberos v2 wrap token whose 16-bit "extra count" (ec) field exceeds the plaintext length—a structurally malformed token per RFC 4121 . ...

CVE-2026-89537

CVE-2026-89537 affects the Linux kernel's SUNRPC subsystem, specifically the gss_krb5_verify_mic_v2() function, which reads RFC 4121 MIC token header fields without first validating the token length. A remote malicious NFS server can supply an undersized Kerberos MIC token, causing the verifier t...

CVE-2026-89536

CVE-2026-89536 is a race condition in the Linux kernel SUNRPC subsystem's client TLS handshake process. When a handshake is cancelled due to a timeout or signal, the synchronous waiter can prematurely drop the reference to the lower transport if the completion callback is still in flight, leading...

CVE-2026-89536 SUNRPC: wait for in-flight client TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

EUVD-2026-76442

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

CVE-2026-89536 SUNRPC: wait for in-flight client TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

CVE-2026-89536

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

PT-2026-90255

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gssx dec option array function fails to properly handle duplicate CREDS VALUE options in a wire-supplied option array. When multiple CRE...

PT-2026-90267

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the SUNRPC component. The xdr buf trim function trims bytes from the tail of an xdr buf by iterating through tail, pages, and head iovecs. A failure to cla...

CVE-2026-89541: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gssunwrapresppriv length checks gssunwrapresppriv validates the RPCSECGSS opaque length with offset = u8 p - u8 head-iovbase; if offset + opaquelen rcvbuf-len goto unwrapfailed; majstat = gssunwrapctx-gcgssctx,...

CVE-2026-89545: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rqargp and rqresp free until after RCU grace period svcrqstfree frees rqstp-rqargp and rqstp-rqresp synchronously via kfree, but defers the rqstp struct free via kfreercu. After svcexitthread calls listdelrcu and...

CVE-2026-89548: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

CVE-2026-89550: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

PT-2026-96566

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth gss: enforce krb5 token minimum length svcauth gss unwrap priv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gss unwrap: if len xdr stream remainingxdr goto unwrap...

PT-2026-90254

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss krb5 unwrap v2 function fails to properly validate the 16-bit extra count ec field in Kerberos v2 token headers. A peer with a valid...

PT-2026-96331

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gss krb5 unwrap v2 sets buf-len to a logical length, which can be much smaller than head0.iov len the allocated receive-page capacity. It then calls xdr buf trim with a...

PT-2026-90260

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Four coupled defects in the gssx XDR option-array decoder create unsafe error paths. These issues include a NULL dereference in the caller, a reference count leak on the decoded group...

PT-2026-96479

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss krb5 unwrap v2 against short tokens gss krb5 unwrap v2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSS KRB5 TOK HDR LEN 16 bytes long, and its rotate left...