Cloudanix VulnDB

CVE-2026-89544

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux kernel networking code can cause systems to crash when handling certain security checks, potentially disrupting services.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Defects in the gssx_dec_option_array and related credential decoding functions in the Linux kernel's SUNRPC implementation cause NULL pointer dereference, reference count leaks on group_info structures, and potential use-after-free conditions during error handling in GSS security context acceptance.

Why it matters to the business

Systems may experience kernel crashes or instability when processing certain RPC authentication requests, leading to denial of service and operational disruption for networked services relying on the kernel.

How an attack unfolds

An attacker sends a crafted GSS accept sec context upcall or network packet that triggers allocation failure or error paths in gssx_dec_option_array, leading to NULL deref in the caller or mishandled group info causing UAF.

How to fix it

Update to a patched Linux kernel version that includes the fixes for the error paths in gssx_dec_option_array and free_svc_cred handling.

How to confirm the fix worked

Verify the kernel source includes the corrected allocation order, count reset, and proper put_group_info calls in the decoder functions.

Typical attack path

  1. Send malicious RPC packet targeting SUNRPC GSS decoder
  2. Trigger error path in gssx_dec_option_array by causing allocation failure
  3. Cause NULL dereference or refcount mishandling leading to crash or UAF

How to detect it

Look for kernel oops or panic logs involving gssx_dec_option_array or gssp_accept_sec_context_upcall in system logs.

What your security team should do

  • Apply kernel updates promptly to address the error path defects
  • Monitor system logs for SUNRPC related crashes or oops
  • Restrict exposure of NFS or Kerberos services to untrusted networks where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose. gssx_dec_option_array() sets oa->count = 1 before allocating oa->data. If that allocation fails, -ENOMEM is returned with oa->count == 1 and oa->data == NULL. All other error paths jump to free_oa: which frees oa->data and NULLs it but also leaves oa->count == 1. The caller trusts the count: gssp_accept_sec_context_upcall() gssx_dec_accept_sec_context() gssx_dec_option_array() /* fails, count=1 data=NULL */ data = res.options.data[0].value /* NULL deref */ Independently, free_creds: releases the partially decoded svc_cred with a bare kfree(creds). gssx_dec_linux_creds() installs a groups_alloc() result into creds->cr_group_info; that object is kvmalloc-backed and refcounted, and only put_group_info() reaches kvfree(). A plain kfree(creds) drops the wrapper and leaks the group_info allocation. The natural fix for the leak is to call free_svc_cred(creds) before kfree(creds), but free_svc_cred() invokes put_group_info() on creds->cr_group_info unconditionally when non-NULL. The existing out_free_groups: path in gssx_dec_linux_creds() already called groups_free() on that pointer without clearing it, so once free_svc_cred() is wired in, the subsequent put_group_info() would touch freed memory. Fix all four together: - Move the oa->count = 1 assignment below the oa->data allocation so it is never set when oa->data is NULL. - Reset oa->count to 0 at free_oa: so count and data stay coherent and the caller sees an empty option array. - Call free_svc_cred(creds) before kfree(creds) at free_creds: so the refcounted cr_group_info is released. free_svc_cred() either NULL-guards each field explicitly (cr_group_info has an if() check) or delegates to a helper that is NULL-safe itself (kfree for the string fields, gss_mech_put() which guards with if(gm) at gss_mech_switch.c:342), so it is safe to call on a partially decoded svc_cred where only cr_uid/cr_gid/cr_group_info have been written and everything else is zero from kzalloc. - In gssx_dec_linux_creds()'s out_free_groups: path, release cr_group_info with put_group_info() rather than groups_free() so the teardown matches free_svc_cred()'s refcount-aware path, and clear the pointer so a later free_svc_cred() on the same creds does not release it a second time.

Affected packages

Ecosystem Package Introduced Fixed