Executive brief
The Linux kernel's SUNRPC implementation used for NFS file sharing contains an integer overflow vulnerability in RPCSEC_GSS (Kerberos) reply validation. A malicious NFS server can send a specially crafted response that bypasses length checks, causing the client to read memory beyond allocated buffers. This could lead to information disclosure or system crashes on NFS clients communicating with compromised or attacker-controlled Kerberos-authenticated servers.
Technical details
The vulnerability is an integer overflow in gss_unwrap_resp_priv() within the SUNRPC subsystem. The function validates the opaque length of RPCSEC_GSS replies by computing offset + opaque_len in u32 arithmetic; when opaque_len is near 0xffffffff, this sum wraps around to a small value, bypassing the upper bound check and allowing gss_unwrap() to be called with end < begin. Additionally, the check lacks a lower bound, accepting any opaque_len smaller than GSS_KRB5_TOK_HDR_LEN (typically 16 bytes), which causes gss_krb5_unwrap_v2() to read out-of-bounds memory. The fix replaces the single combined check with three separate guards enforcing proper bounds and a minimum RFC 4121 token length, making arithmetic safe in u32 domain. This requires network access to an NFS server and affects clients receiving Kerberos-authenticated responses.
Affected products
- Linux Linux kernel versions prior to the patch
Timeline
- 2026-09-11: disclosed: CVE-2026-89541 published
- patched: Patch available with three-check fix replacing single combined check