Executive brief
The Linux kernel's SUNRPC authentication module contains a flaw in how it validates Kerberos 5 security tokens used for secure remote procedure calls. An attacker can craft a malformed token that bypasses validation checks and triggers a division-by-zero crash in the kernel, causing denial of service or potential privilege escalation on systems relying on Kerberos-authenticated network services.
Technical details
The vulnerability exists in svcauth_gss_unwrap_priv() within the SUNRPC GSS authentication handler. The function validates only an upper bound on the wire-supplied opaque token length before passing it to gss_unwrap(), but fails to enforce a minimum length requirement. This allows a token with length <= 16 bytes (GSS_KRB5_TOK_HDR_LEN) to pass initial validation. Such truncated tokens subsequently reach gss_krb5_unwrap_v2(), which attempts to read RFC 4121 header fields at fixed offsets without verifying sufficient data is present, leading to out-of-bounds reads. The rotate_left() function then performs a modulo operation (shift %= buf->len) on a zero or near-zero length buffer, causing a division by zero. The fix adds a minimum-length check (len > GSS_KRB5_TOK_HDR_LEN) immediately after the existing upper-bound validation to reject invalid tokens at the entry point.
Affected products
- Linux Linux kernel unknown
Timeline
- 2026-09-11: disclosed