Executive brief
The Linux kernel's SUNRPC (Sun Remote Procedure Call) subsystem, which is used for network file sharing protocols like NFS, contains a memory leak vulnerability. A malicious or attacker-controlled RPC server can send crafted authentication messages with duplicate credential entries, causing the kernel to leak memory and potentially exhaust system resources, leading to performance degradation or denial of service.
Technical details
The vulnerability is a use-after-free / memory leak in the gssx_dec_option_array() function in net/sunrpc/auth_gss/gss_rpc_xdr.c. When processing GSSAPI credential options from an untrusted wire-supplied RPC message, the code fails to validate that CREDS_VALUE options appear only once. On receiving a second CREDS_VALUE entry, gssx_dec_linux_creds() unconditionally overwrites the cr_group_info pointer without releasing the previously allocated group_info structure, orphaning the kvmalloc-backed memory. The vulnerability requires network access to trigger (attacker must be positioned to send malicious RPC replies) and affects all versions of the Linux kernel with SUNRPC GSS support. A fix tracking whether CREDS_VALUE has been decoded and rejecting duplicates has been applied to stable branches.
Affected products
- Linux Linux kernel All versions with SUNRPC GSS support
Timeline
- 2026-09-11: disclosed
- 2026-08-10: patched: Patch committed upstream; backported to stable branches by 2026-09-07