Executive brief
The Linux kernel's SUNRPC subsystem contains multiple bugs in the gssx XDR decoder that can cause system crashes and memory corruption. An attacker exploiting these flaws could crash the kernel or potentially execute code, disrupting services that rely on the SUNRPC authentication framework and potentially compromising the entire system.
Technical details
The vulnerability comprises four coupled defects in gssx_dec_option_array() and related error handling paths: (1) oa->count is set to 1 before oa->data allocation, leading to a NULL pointer dereference in the caller when allocation fails; (2) error paths in free_oa leave oa->count=1 with oa->data=NULL, maintaining incoherent state; (3) the free_creds path performs a bare kfree() on a structure containing a refcounted group_info object, causing a leak when the proper put_group_info() release mechanism is bypassed; (4) a latent use-after-free in the out_free_groups path where groups_free() is called without clearing the pointer, allowing a subsequent put_group_info() to access freed memory. The fix reorders initialization, resets counts on error, calls free_svc_cred() to properly release refcounted objects, and uses put_group_info() instead of groups_free() to maintain refcount consistency. Network-reachable SUNRPC services are vulnerable; exploitation requires authentication or network access to trigger the error paths.
Affected products
- Linux Linux kernel All versions prior to patch
Timeline
- 2026-09-11: disclosed