Executive brief
The Linux kernel's SUNRPC (Sun Remote Procedure Call) subsystem contains an integer underflow vulnerability in the xdr_buf_trim() function, which processes network protocol buffers. When processing GSS-encrypted RPC traffic, an attacker can trigger an unsigned integer wraparound that corrupts the buffer length tracking, potentially leading to memory corruption, data disclosure, or remote code execution on systems using Kerberos authentication.
Technical details
The vulnerability is an unsigned integer underflow in the xdr_buf_trim() function in net/sunrpc/xdr.c. The function trims bytes from XDR buffers without clamping the final length calculation; when buf->len is smaller than the sum of iov_lens (as occurs in gss_krb5_unwrap_v2()), the expression (len - trim) exceeds buf->len and the unsigned subtraction wraps to near UINT_MAX. This corrupted length value then propagates through downstream XDR decoders as the authoritative stream bound. The fix clamps the decrement using min_t() to prevent underflow. The vulnerability affects any caller processing GSS-Kerberos wrapped RPC traffic, and no user interaction or authentication is required beyond network reachability to the RPC service.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 7.2 and rolling stable
Timeline
- 2026-09-11: disclosed
- 2026-08-03: patched