CVE-2026-89542

What it actually does

The Linux kernel SUNRPC GSS Kerberos v2 unwrap path (gss_krb5_unwrap_v2) reads EC/RRC header fields before confirming the token is at least GSS_KRB5_TOK_HDR_LEN (16) bytes, then feeds attacker-influenced lengths into rotate_left/xdr_buf_subsegment and post-decrypt memmove arithmetic. Short or malformed tokens cause out-of-bounds kernel reads, unsigned wrap when base exceeds buf->len, a divide-by-zero when remaining length is zero, and an underflowed movelen that can drive a near-UINT_MAX-byte memmove. Impact is kernel memory corruption: oops/panic denial of service and a path to arbitrary kernel memory overwrite.

Why it matters to the business

This is a critical, network-reachable kernel flaw (CVSS 9.8, no privileges or user interaction) on Linux systems that process NFS or other SUNRPC traffic with GSS Kerberos integrity or privacy. Abuse can take file servers and other RPC-exposed hosts offline or, if memory corruption is fully weaponized, yield complete host compromise. The issue has been public for about 34 days, is not in CISA KEV, is not associated with ransomware, and has no reported in-the-wild use, but kernel-level impact on NFS/RPC servers still warrants urgent patching.

How an attack unfolds

An attacker who can deliver GSS-API Kerberos v2 wrap tokens to a vulnerable kernel—typically via NFS or another SUNRPC service using krb5i/krb5p—sends a token shorter than the 16-byte header, or one whose declared length places the rotation base past the end of the XDR buffer. The unwrap routine reads header fields past the buffer, then rotates or moves kernel buffers using wrapped or zero remaining lengths. The host panics (divide-by-zero, oops, or huge memmove) or suffers kernel memory corruption that can be steered toward privilege escalation. No named threat actors or ransomware campaigns are currently tied to this issue.

How to fix it

Install a Linux kernel that includes the SUNRPC hardening of gss_krb5_unwrap_v2: reject tokens with (len - offset) < GSS_KRB5_TOK_HDR_LEN before reading header fields; bail from rotate_left when buf->len <= base; return early from _rotate_left on zero-length buffers; and replace the dead BUG_ON with a live GSS_S_DEFECTIVE_TOKEN check before the movelen subtraction. Apply vendor/distro kernel security updates that contain this change and reboot into the patched kernel—the fix is in-kernel and cannot be applied as a userspace-only update. Until patched, restrict NFS/SUNRPC to trusted networks, limit who can send RPC with host firewalls and export controls, and disable krb5i/krb5p only if that is operationally acceptable.

How to confirm the fix worked

Confirm the running kernel changelog or stable commit list includes the SUNRPC change that hardens gss_krb5_unwrap_v2 against short tokens. Verify vendor kernel advisories list your installed package as fixed, then reboot and confirm uname -r matches that build. On a non-production host, inspect the unwrap core for the early GSS_KRB5_TOK_HDR_LEN check, the buf->len <= base guard, the zero-length return in _rotate_left, and a defective-token return instead of the old BUG_ON. Legitimate NFS/GSS traffic should continue to succeed after the patch. Do not validate by sending malformed wrap tokens on production systems.

Typical attack path

1. Identify Linux hosts exposing NFS or other SUNRPC services that negotiate GSS Kerberos wrap (krb5i/krb5p).
2. Cause the server to process attacker-supplied GSS-KRB5 wrap tokens in gss_krb5_unwrap_v2.
3. Supply a wrap token shorter than the 16-byte header, or one whose length/offset makes the rotation base meet or exceed the buffer length.
4. Trigger out-of-bounds header reads, rotate_left integer wrap or divide-by-zero, or post-decrypt memmove underflow in kernel context.
5. Convert the resulting kernel fault into denial of service, or convert memory corruption into kernel-level control of the host.

How to detect it

There is no reliable pre-crash userspace log of successful exploitation. Review the kernel ring buffer and persistent oops/kdump logs (dmesg, journalctl -k, kern.log, crash dumps, pstore) on NFS/RPC servers for oops, BUG, divide-error, or general-protection faults whose call traces include gss_krb5_unwrap_v2, rotate_left, _rotate_left, xdr_buf_subsegment, svcauth_gss, or rpcsec_gss. Correlate sudden nfsd/lockd restarts, unexplained reboots, and hung exports with RPC clients active at the time. Packet captures showing unusually short GSS wrap tokens immediately before a crash support triggering but do not prove a finished exploit. No named threat actors or ransomware use are associated with this CVE at 34 days after publication.

• gss_krb5_unwrap_v2
• svcauth_gss
• rpcsec_gss
• xdr_buf_subsegment
• RIP: 0010:gss_krb5
• divide error

What your security team should do

• Patch and reboot NFS/SUNRPC servers first this cycle given CVSS 9.8 and a network attack vector, even though the CVE is not in CISA KEV and has no known active exploitation.
• Inventory hosts running nfsd or other SUNRPC GSS-KRB5 (sec=krb5/krb5i/krb5p) and track kernel versions until the gss_krb5_unwrap_v2 hardening is present.
• Until patched, restrict TCP/UDP 2049 and related RPC ports to known clients and review export/GSS configuration.
• Hunt historical kernel oopses in gss_krb5, rpcsec_gss, or sunrpc that could indicate attempted or accidental triggering.
• Follow distro kernel advisories until the fix appears in your LTS/enterprise stream; treat kernel DoS/corruption on file servers as urgent.