CVE-2026-89541
Description
A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the gss_unwrap_resp_priv() function within the SUNRPC component. This flaw occurs when validating the length of RPCSEC_GSS opaque data. A malicious krb5p Network File System (NFS) server can send a specially crafted RPCSEC_GSS reply, leading to an out-of-bounds read. This could potentially result in information disclosure or a denial of service (DoS) on the client system.
Statement
A length validation flaw in the SUNRPC RPCSEC_GSS client privacy unwrap path can allow a crafted server reply to bypass bounds checks. The vulnerable check used offset plus opaque_len with u32 arithmetic, so a very large opaque_len can wrap the computed end offset and make gss_unwrap operate on an invalid range. A too short opaque_len can also pass into the Kerberos unwrap code and cause out of bounds reads while parsing the token header or during later buffer rotation. For the CVSS the PR:N value is used because the attacker does not need an account or code execution on the client and can act through a malicious or compromised NFS server endpoint. The issue is network reachable in deployments where an NFS client uses RPCSEC_GSS privacy mode such as krb5p against an attacker controlled or compromised server. Impact is at least denial of service via kernel crash and may include limited confidentiality exposure from out of bounds reads. Integrity impact is kept limited in the paranoid score because no clear arbitrary write primitive is shown.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
