Executive brief
A vulnerability in the Linux kernel's SUNRPC component could allow for memory leaks during network communication. SUNRPC is a protocol used for remote procedure calls, often in network file sharing environments. If an error occurs while processing specific security-related messages, the system fails to release allocated memory, which could eventually lead to system instability or performance degradation if repeatedly triggered.
Technical details
A memory leak vulnerability exists in the Linux kernel's SUNRPC auth_gss implementation. The functions gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() allocate memory via gssx_dec_buffer() (which utilizes kmemdup()). When a subsequent XDR decoding operation fails, these functions return an error immediately without freeing previously allocated buffers. This is particularly impactful in gssp_accept_sec_context_upcall, where multiple buffer length fields are initialized to non-zero values, leading to unreferenced memory that cannot be reclaimed. The fix introduces proper error handling with goto-based cleanup to ensure all allocated buffers are freed upon failure.
Affected products
- Linux Linux kernel versions prior to 6.13.y
Timeline
- 2026-05-27: advisory: CVE-2026-45870 published in NVD
- 2026-02-26: patched: Committed to stable Linux kernel tree
References
- https://git.kernel.org/stable/c/3b56eb90feb8a3709417f5624f3871847d42bcb1
- https://git.kernel.org/stable/c/3e6397b056335cc56ef0e9da36c95946a19f5118
- https://git.kernel.org/stable/c/64303b92d94c0c7845a273acd8d84b796d6f1db7
- https://git.kernel.org/stable/c/b4af3806846778799cd4ab0766dc18341e777264
- https://git.kernel.org/stable/c/c81431b1b9fbd21e9a5a9211b5517b7295d18e6a
- https://git.kernel.org/stable/c/caf7eff432e91a9eba1c79fa545c2f54be15d62b
- https://git.kernel.org/stable/c/d79b9097a6a2b91471b40755f1225364be5d85ff