SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89551
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-11 20:19:38 UTC
Updated2026-09-14 13:19:10 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp: fix_len: buf->len -= (len - trim); When the caller has set buf->len to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf->len and the unsigned subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches xdr_buf_trim() in exactly that state: buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip); xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); buf->len is a small wire-derived value while the iov_lens are at page scale, so the per-section loops legitimately consume far more bytes than buf->len records. The wrapped buf->len then propagates as the authoritative stream bound into every downstream XDR decoder. Fix by clamping the decrement so buf->len bottoms out at zero: buf->len -= min_t(unsigned int, buf->len, len - trim); On the normal path where the iov_lens sum to buf->len, (len - trim) is always <= buf->len and the result is identical to before. No callers change behavior outside the underflow case.

Risk And Classification

Primary CVSS: v3.1 9.8 CRITICAL from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.004630000 probability, percentile 0.388690000 (date 2026-09-14)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED9.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 4c190e2f913f038c9c91ee63b59cd037260ba353 a3d77bcd974b8625d16bddf448cb3a1b5e37049c git Not specified
CNA Linux Linux affected 4c190e2f913f038c9c91ee63b59cd037260ba353 fa16bbe987b47e771e52eeb1b4540f18d92496ac git Not specified
CNA Linux Linux affected 4c190e2f913f038c9c91ee63b59cd037260ba353 a924ac4c78afab71bf82641afa3b62e0c4a8b55e git Not specified
CNA Linux Linux affected 4c190e2f913f038c9c91ee63b59cd037260ba353 4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4 git Not specified
CNA Linux Linux affected 4c190e2f913f038c9c91ee63b59cd037260ba353 e6267cccd7b05cc514e57f2160aa8db85f5c2701 git Not specified
CNA Linux Linux affected 4c190e2f913f038c9c91ee63b59cd037260ba353 ad0cce80d4af2f74674e8b635d97aa3880e83da8 git Not specified
CNA Linux Linux affected 4c190e2f913f038c9c91ee63b59cd037260ba353 85e9602650e9df07190abe817cee3b4d9bc3df17 git Not specified
CNA Linux Linux affected 4c190e2f913f038c9c91ee63b59cd037260ba353 3f491306dcb673ff5e78e1044ba450c58978774e git Not specified
CNA Linux Linux affected 3.9 Not specified
CNA Linux Linux unaffected 3.9 semver Not specified
CNA Linux Linux unaffected 5.10.270 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.109 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.50 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.4 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report