CVE-2026-89550

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: svcauth_gss: enforce krb5 token minimum length

svcauth_gss_unwrap_priv() validates only an upper bound on the

wire-supplied opaque length before handing the buffer to

gss_unwrap():

if (len > xdr_stream_remaining(xdr))

goto unwrap_failed;

offset = xdr_stream_pos(xdr);

...

maj_stat = gss_unwrap(ctx, offset, offset + len, buf);

The wire value `len` flows unchanged as the upper bound into the

krb5 unwrap path, so a len in [0, 16] passes this check and is

handed to gss_unwrap(). For a krb5 v2 context that lands in

gss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token

header fields at ptr+4 and ptr+6 and then calls rotate_left()

before any integrity check. With a sub-header length the header

reads run past the token, and _rotate_left()'s `shift %= buf->len`

path can divide by zero when buf->len has been driven to zero by

the truncated token. A header-only token (len == 16) is eq

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References