Executive brief
A memory management issue was identified in the Linux kernel's SUNRPC component, which handles remote procedure calls. A specific error handling path failed to release a reference to an internal structure, leading to a memory leak. Over time, this could potentially degrade system performance or lead to resource exhaustion, though it typically requires specific local conditions to trigger.
Technical details
A reference counting vulnerability exists in net/sunrpc/auth_gss/auth_gss.c within the gss_alloc_msg function. The function calls kref_get(&gss_auth->kref) to balance a subsequent put, but fails to call kref_put() if kstrdup_const() fails for the service_name. This results in the gss_auth structure never being freed, causing a kernel memory leak. The fix introduces a forward declaration for gss_free_callback() and ensures kref_put() is called in the err_put_pipe_version error path. This is primarily a local denial-of-service vector via resource exhaustion.
Affected products
- Linux Linux kernel All versions prior to the fix in SUNRPC auth_gss.c
Timeline
- 2026-02-06: other: Patch authored by Daniel Hodges
- 2026-05-27: disclosed: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/3b2b6c42070ce4204936288253baf101e995c2d3
- https://git.kernel.org/stable/c/655c9ba9915f05266998dbbf4b76b3c79b8a70aa
- https://git.kernel.org/stable/c/a1bc9561b617ec7e2d09e6c134d1db8fcf9ca4a6
- https://git.kernel.org/stable/c/a2d4e9a76de0b2178001214ba5de5bf94a7354aa
- https://git.kernel.org/stable/c/b559be2ec6cdb2e9c2c36c23fbbd4690d8a5c3f7
- https://git.kernel.org/stable/c/c20f925214249bb4fc04f7e197bea142a6438af6
- https://git.kernel.org/stable/c/dd2fdc3504592d85e549c523b054898a036a6afe