Executive brief
A vulnerability in the Linux kernel's SUNRPC (Sun Remote Procedure Call) component fails to validate the length of Kerberos authentication tokens before processing them. An attacker operating a malicious NFS server can send specially crafted short tokens that cause the kernel to read beyond allocated memory buffers, potentially exposing sensitive information or causing a denial of service on systems using Kerberos-authenticated NFS.
Technical details
The gss_krb5_verify_mic_v2() function in the SUNRPC subsystem reads token header fields and checksums without first validating that the supplied token meets the minimum safe length of GSS_KRB5_TOK_HDR_LEN (16 bytes) plus the cryptographic checksum length (12–24 bytes depending on encryption type). Multiple code paths that call gss_verify_mic() perform only partial validation: gss_unwrap_resp_integ() checks only an upper bound before kmalloc, while gss_validate() and svcauth_gss_verify_header() enforce minimal or no lower bounds. An attacker controlling an NFS server can supply undersized tokens, triggering an out-of-bounds read. The fix adds a length guard at the entry to gss_krb5_verify_mic_v2() to reject tokens shorter than the minimum safe size, with no impact on legitimate Kerberos traffic.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed