{"id":"CVE-2026-93207","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= b0bc53470d1af01f62a0fe2d405cf56477804863 < 56b29d62017c7dd1718d060dd5b3a2ce61095d0c","Linux >= b0bc53470d1af01f62a0fe2d405cf56477804863 < 0e18641708eaa8bc3c1ff338cd844aeadbd52bac","Linux >= b0bc53470d1af01f62a0fe2d405cf56477804863 < e0778464049b0238f2915a40007a4154f86cf351","Linux >= b0bc53470d1af01f62a0fe2d405cf56477804863 < 0fa8a8acae57e6373962741d5b06d13f44aba6a9","Linux >= b0bc53470d1af01f62a0fe2d405cf56477804863 < 11539e8fcce0b0af062ae5fecf7b3676c2f7aeed","Linux 6.3"],"published":"2026-09-24","updated":"2026-09-25","sourceUpdated":"2026-09-25T05:16:58.630","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93207","references":[{"url":"https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93207.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93207"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2540182"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93207"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93207"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93207.mbox"},{"url":"https://access.redhat.com/errata/RHSA-2026:83207"},{"url":"https://access.redhat.com/errata/RHSA-2026:83156"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"ingestedAt":"2026-09-24T15:45:56.673Z","epss":0.00467,"epssPercentile":0.40247,"cwe":["CWE-825"],"scores":{"nvd":9.8,"vendor":7,"cna":9.8},"patched":["10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"slug":"CVE-2026-93207","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail.  The caller storage is svcdata->clcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests.  Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value.  Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93207.json)\n- **RHSA-2026:83207** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:83207)\n- **RHSA-2026:83156** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:83156)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":210505,"id":"CVE-2026-93207","ts":1790316054226,"field":"cvss","old":null,"new":"9.8"},{"seq":210504,"id":"CVE-2026-93207","ts":1790316054226,"field":"severity","old":"none","new":"critical"}]}