CVE-2026-93207

A flaw of moderate impact was found in the Linux kernel's SUNRPC subsystem, in the server-side GSS credential decoding path svcauth_gss_decode_credbody(). The function writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail, while the destination storage (svcdata->clcred in the per-svc_rqst gss_svc_data) is pooled and reused across requests. Early decode failures therefore leave partially decoded state mixed with residue from the previous request. In the sharpest case, the trailing body_len tightness check leaves gc_ctx.data pointing into the current request's XDR pages while gc_ctx.len retains a stale value from a prior request; once those pages are released, the pooled credential carries a dangling pointer paired with a stale length, which length-driven consumers such as gss_svc_searchbyctx() may otherwise walk, a form of memory corruption. Per the CVE description, a remote attacker able to trigger early decode failures against an RPC service using GSS authentication (for example NFS with RPCSEC_GSS) could use this issue to cause a denial of service through incorrect state management and system instability. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL 9 CoreOS are affected, and fixes are being pursued for those streams. RHEL 6, 7, 8, and 9.2, and OpenShift Container Platform releases built on RHEL 8 CoreOS, are not affected because the vulnerable code is not present in those kernels. Red Hat's severity assessment (impact Moderate, CVSS 3.1 score 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) differs significantly from the upstream CVEORG rating of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): the Red Hat vector reflects a local attack vector with high attack complexity and some privileges required, whereas the upstream record treats the flaw as remotely exploitable without privileges; the primary documented consequence is denial of service.