{"id":"CVE-2026-89537","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n\ngss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags\nbyte at ptr[2], and padding at p…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n\ngss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags\nbyte at ptr[2], and padding at p…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-125"],"vendor":"Linux","product":"Linux","affected":["Linux >= de9c17eb4a912c9028f7b470eb80815144883b26 < 996dd15f60121bdd7896b4554458f8806d608063","Linux >= de9c17eb4a912c9028f7b470eb80815144883b26 < 7a946b2e7207f968902f2147ab9b30726f82f7ab","Linux >= de9c17eb4a912c9028f7b470eb80815144883b26 < b94f6719dcd9f7a609bc5f459f85795900e77d25","Linux 2.6.35"],"published":"2026-09-11","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:54.090","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89537","references":[{"url":"https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/996dd15f60121bdd7896b4554458f8806d608063","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89537.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89537"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532109"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89537"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89537"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89537.mbox"},{"url":"https://git.kernel.org/stable/c/b2e9e10f5a536befcdce64d3e6946dff42fb823e"},{"url":"https://git.kernel.org/stable/c/997577c52487181226775db3755079a3ba1d52b9"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00653,"epssPercentile":0.51096,"scores":{"nvd":9.1,"cna":9.1,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.474Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T19:23:15.980324Z"},"slug":"CVE-2026-89537","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n\ngss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags\nbyte at ptr[2], and padding at ptr[3..7], then passes\nptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().\nNone of these accesses check read_token->len first.\n\nThe minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus\nctx->krb5e->cksum_len (12-24, depending on the enctype).  All callers\naccept shorter tokens from the wire:\n\n - gss_unwrap_resp_integ() enforces only an upper bound\n   (offset + len <= rcv_buf->len) before allocating\n   mic.data = kmalloc(len) and passing it to gss_verify_mic().\n   A malicious NFS server can therefore supply a short checksum\n   opaque, producing a small slab allocation that the Kerberos MIC\n   verifier reads past.\n\n - gss_validate() enforces only len <= RPC_MAX_AUTH_SIZE (400)\n   before passing the wire-supplied length to\n   gss_validate_seqno_mic(), which constructs a mic xdr_netobj\n   and calls gss_verify_mic().\n\n - svcauth_gss_verify_header() enforces only\n   checksum.len >= XDR_UNIT (4 bytes) before dispatching to\n   gss_verify_mic().\n\n - svcauth_gss_unwrap_integ() checks only that the checksum fits\n   in gsd->gsd_scratch.\n\nAdd a length guard at the top of gss_krb5_verify_mic_v2(), before any\nptr[] access or scatterlist construction.  Well-formed MIC tokens from\ngss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +\ncksum_len bytes, so valid traffic is unaffected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89537.json)","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222167,"id":"CVE-2026-89537","ts":1792062152927,"field":"cvss","old":"7","new":"9.1"},{"seq":222166,"id":"CVE-2026-89537","ts":1792062152927,"field":"severity","old":"high","new":"critical"},{"seq":208108,"id":"CVE-2026-89537","ts":1789922711075,"field":"cvss","old":"6.4","new":"7"},{"seq":208107,"id":"CVE-2026-89537","ts":1789922711075,"field":"severity","old":"medium","new":"high"},{"seq":202887,"id":"CVE-2026-89537","ts":1789403732814,"field":"cvss","old":"9.1","new":"6.4"},{"seq":202886,"id":"CVE-2026-89537","ts":1789403732814,"field":"severity","old":"critical","new":"medium"},{"seq":197953,"id":"CVE-2026-89537","ts":1789384321120,"field":"cvss","old":"6.4","new":"9.1"},{"seq":197952,"id":"CVE-2026-89537","ts":1789384321120,"field":"severity","old":"medium","new":"critical"},{"seq":183486,"id":"CVE-2026-89537","ts":1789356675568,"field":"cvss","old":"9.1","new":"6.4"},{"seq":183485,"id":"CVE-2026-89537","ts":1789356675568,"field":"severity","old":"critical","new":"medium"},{"seq":153334,"id":"CVE-2026-89537","ts":1789285350089,"field":"cvss","old":null,"new":"9.1"},{"seq":153333,"id":"CVE-2026-89537","ts":1789285350089,"field":"severity","old":"none","new":"critical"},{"seq":147798,"id":"CVE-2026-89537","ts":1789270212330,"field":"cvss","old":null,"new":"6.4"},{"seq":147797,"id":"CVE-2026-89537","ts":1789270212330,"field":"severity","old":"none","new":"medium"},{"seq":109552,"id":"CVE-2026-89537","ts":1789183732386,"field":"cvss","old":null,"new":"6.4"},{"seq":109551,"id":"CVE-2026-89537","ts":1789183732386,"field":"severity","old":"none","new":"medium"}]}