Executive brief
Linux systems running vulnerable kernel versions expose a critical flaw in the SUNRPC (Sun Remote Procedure Call) authentication layer used for NFS and other network services. A remote attacker can send a malformed Kerberos token that causes the kernel to read memory outside buffer boundaries and perform unsafe operations, potentially crashing the system or executing arbitrary code.
Technical details
The vulnerability is an out-of-bounds (OOB) read and integer underflow in the gss_krb5_unwrap_v2() function within the Linux kernel's SUNRPC GSS-API Kerberos implementation. The function reads EC and RRC header fields from a token without first validating that the token meets the minimum length requirement (GSS_KRB5_TOK_HDR_LEN = 16 bytes), leading to OOB reads on short tokens. Additionally, a rotate_left() helper function can trigger integer wraparound and divide-by-zero errors when processing tokens whose declared length places calculations past buffer boundaries. The attack requires network access to a system running NFS or similar SUNRPC-dependent services with Kerberos authentication enabled. No patch information is provided in the advisory, but defense-in-depth validation checks have been documented as the recommended fix.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed