CVE-2026-89539

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: reject duplicate CREDS_VALUE options

gssx_dec_option_array() walks the wire-supplied option array and, for

every entry whose name matches CREDS_VALUE, calls

gssx_dec_linux_creds() on the same struct svc_cred. That helper

unconditionally installs a fresh groups_alloc() result into

creds->cr_group_info without releasing whatever pointer was already

there:

for (i = 0; i < count; i++) {

... decode name ...

if (length == sizeof(CREDS_VALUE) &&

memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {

err = gssx_dec_linux_creds(xdr, creds);

...

}

}

A reply that carries two CREDS_VALUE entries therefore overwrites

cr_group_info on the second iteration and orphans the group_info

allocated by the first call. The earlier free_creds path only

releases the last cr_group_info via free_svc_cred(), so the first

allocation's refcount stays at one and its kvmallo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References