SUNRPC: fix gssx_dec_option_array error path bugs

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89544
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-11 20:19:37 UTC
Updated2026-09-13 07:17:16 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose. gssx_dec_option_array() sets oa->count = 1 before allocating oa->data. If that allocation fails, -ENOMEM is returned with oa->count == 1 and oa->data == NULL. All other error paths jump to free_oa: which frees oa->data and NULLs it but also leaves oa->count == 1. The caller trusts the count: gssp_accept_sec_context_upcall() gssx_dec_accept_sec_context() gssx_dec_option_array() /* fails, count=1 data=NULL */ data = res.options.data[0].value /* NULL deref */ Independently, free_creds: releases the partially decoded svc_cred with a bare kfree(creds). gssx_dec_linux_creds() installs a groups_alloc() result into creds->cr_group_info; that object is kvmalloc-backed and refcounted, and only put_group_info() reaches kvfree(). A plain kfree(creds) drops the wrapper and leaks the group_info allocation. The natural fix for the leak is to call free_svc_cred(creds) before kfree(creds), but free_svc_cred() invokes put_group_info() on creds->cr_group_info unconditionally when non-NULL. The existing out_free_groups: path in gssx_dec_linux_creds() already called groups_free() on that pointer without clearing it, so once free_svc_cred() is wired in, the subsequent put_group_info() would touch freed memory. Fix all four together: - Move the oa->count = 1 assignment below the oa->data allocation so it is never set when oa->data is NULL. - Reset oa->count to 0 at free_oa: so count and data stay coherent and the caller sees an empty option array. - Call free_svc_cred(creds) before kfree(creds) at free_creds: so the refcounted cr_group_info is released. free_svc_cred() either NULL-guards each field explicitly (cr_group_info has an if() check) or delegates to a helper that is NULL-safe itself (kfree for the string fields, gss_mech_put() which guards with if(gm) at gss_mech_switch.c:342), so it is safe to call on a partially decoded svc_cred where only cr_uid/cr_gid/cr_group_info have been written and everything else is zero from kzalloc. - In gssx_dec_linux_creds()'s out_free_groups: path, release cr_group_info with put_group_info() rather than groups_free() so the teardown matches free_svc_cred()'s refcount-aware path, and clear the pointer so a later free_svc_cred() on the same creds does not release it a second time.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.005670000 probability, percentile 0.452440000 (date 2026-09-13)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.1CNADECLARED7.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 3cfcfc102a5e57b021b786a755a38935e357797d 3ff45361e9469e85c0f86b8e7b82c63e50bab8ef git Not specified
CNA Linux Linux affected 3cfcfc102a5e57b021b786a755a38935e357797d f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a git Not specified
CNA Linux Linux affected 3cfcfc102a5e57b021b786a755a38935e357797d 5e9a94539b1ec17a89177d952badfd0d844d694a git Not specified
CNA Linux Linux affected b97c37978ca825557d331c9012e0c1ddc0e42364 git Not specified
CNA Linux Linux affected bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8 git Not specified
CNA Linux Linux affected bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8 git Not specified
CNA Linux Linux affected dd292e884c649f9b1c18af0ec75ca90b390cd044 git Not specified
CNA Linux Linux affected 934212a623cbab851848b6de377eb476718c3e4c git Not specified
CNA Linux Linux affected 5e6013ae2c8d420faea553d363935f65badd32c3 git Not specified
CNA Linux Linux affected 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4 git Not specified
CNA Linux Linux affected 996997d1fb2126feda550d6adcedcbd94911fc69 git Not specified
CNA Linux Linux affected 4.19.311 4.20 semver Not specified
CNA Linux Linux affected 5.4.273 5.5 semver Not specified
CNA Linux Linux affected 5.10.214 5.11 semver Not specified
CNA Linux Linux affected 5.15.153 5.16 semver Not specified
CNA Linux Linux affected 6.1.83 6.2 semver Not specified
CNA Linux Linux affected 6.6.23 6.7 semver Not specified
CNA Linux Linux affected 6.7.11 6.8 semver Not specified
CNA Linux Linux affected 6.8.2 6.9 semver Not specified
CNA Linux Linux affected 6.9 Not specified
CNA Linux Linux unaffected 6.9 semver Not specified
CNA Linux Linux unaffected 6.18.51 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.4 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/3ff45361e9469e85c0f86b8e7b82c63e50bab8ef 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5e9a94539b1ec17a89177d952badfd0d844d694a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report