{"id":"CVE-2026-45870","title":"SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: auth_gss: fix memory leaks in XDR decoding error paths\n\nThe gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name()\nfunctions allocate memory via gssx_dec_buffer…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < c81431b1b9fbd21e9a5a9211b5517b7295d18e6a","Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < caf7eff432e91a9eba1c79fa545c2f54be15d62b","Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < 64303b92d94c0c7845a273acd8d84b796d6f1db7","Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < df10f23defff22c8d55fe6db74f6e4ce927145bf","Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < b4af3806846778799cd4ab0766dc18341e777264","Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < d79b9097a6a2b91471b40755f1225364be5d85ff","Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < 3b56eb90feb8a3709417f5624f3871847d42bcb1","Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < 3e6397b056335cc56ef0e9da36c95946a19f5118","Linux 3.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:42:55.762551Z"},"published":"2026-05-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:53:09.788Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45870","references":[{"url":"https://git.kernel.org/stable/c/c81431b1b9fbd21e9a5a9211b5517b7295d18e6a"},{"url":"https://git.kernel.org/stable/c/caf7eff432e91a9eba1c79fa545c2f54be15d62b"},{"url":"https://git.kernel.org/stable/c/64303b92d94c0c7845a273acd8d84b796d6f1db7"},{"url":"https://git.kernel.org/stable/c/df10f23defff22c8d55fe6db74f6e4ce927145bf"},{"url":"https://git.kernel.org/stable/c/b4af3806846778799cd4ab0766dc18341e777264"},{"url":"https://git.kernel.org/stable/c/d79b9097a6a2b91471b40755f1225364be5d85ff"},{"url":"https://git.kernel.org/stable/c/3b56eb90feb8a3709417f5624f3871847d42bcb1"},{"url":"https://git.kernel.org/stable/c/3e6397b056335cc56ef0e9da36c95946a19f5118"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.05259,"ingestedAt":"2026-11-06T16:57:43.394Z","slug":"CVE-2026-45870","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: auth_gss: fix memory leaks in XDR decoding error paths\n\nThe gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name()\nfunctions allocate memory via gssx_dec_buffer(), which calls\nkmemdup(). When a subsequent decode operation fails, these\nfunctions return immediately without freeing previously\nallocated buffers, causing memory leaks.\n\nThe leak in gssx_dec_ctx() is particularly relevant because\nthe caller (gssp_accept_sec_context_upcall) initializes several\nbuffer length fields to non-zero values, resulting in memory\nallocation:\n\n    struct gssx_ctx rctxh = {\n        .exported_context_token.len = GSSX_max_output_handle_sz,\n        .mech.len = GSS_OID_MAX_LEN,\n        .src_name.display_name.len = GSSX_max_princ_sz,\n        .targ_name.display_name.len = GSSX_max_princ_sz\n    };\n\nIf, for example, gssx_dec_name() succeeds for src_name but\nfails for targ_name, the memory allocated for\nexported_context_token, mech, and src_name.display_name\nremains unreferenced and cannot be reclaimed.\n\nAdd error handling with goto-based cleanup to free any\npreviously allocated buffers before returning an error.\n\n## Affected\n\n- `Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < c81431b1b9fbd21e9a5a9211b5517b7295d18e6a`\n- `Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < caf7eff432e91a9eba1c79fa545c2f54be15d62b`\n- `Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < 64303b92d94c0c7845a273acd8d84b796d6f1db7`\n- `Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < df10f23defff22c8d55fe6db74f6e4ce927145bf`\n- `Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < b4af3806846778799cd4ab0766dc18341e777264`\n- `Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < d79b9097a6a2b91471b40755f1225364be5d85ff`\n- `Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < 3b56eb90feb8a3709417f5624f3871847d42bcb1`\n- `Linux >= 1d658336b05f8697d6445834f8867f8ad5e4f735 < 3e6397b056335cc56ef0e9da36c95946a19f5118`\n- `Linux 3.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}