Answer in brief
CVE-2026-89544 records a High severity (CVSS 7.5) vulnerability in SUNRPC: fix gssx_dec_option_array error path bugs. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3cfcfc102a5e57b021b786a755a38935e357797d <3ff45361e9469e85c0f86b8e7b82c63e50bab8ef || >=3cfcfc102a5e57b021b786a755a38935e357797d <f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a || >=3cfcfc102a5e57b021b786a755a38935e357797d <5e9a94539b1ec17a89177d952badfd0d844d694a || b97c37978ca825557d331c9012e0c1ddc0e42364 || bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8 || bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8 || dd292e884c649f9b1c18af0ec75ca90b390cd044 || 934212a623cbab851848b6de377eb476718c3e4c || 5e6013ae2c8d420faea553d363935f65badd32c3 || 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4 || 996997d1fb2126feda550d6adcedcbd94911fc69 || >=4.19.311 <4.20 || >=5.4.273 <5.5 || >=5.10.214 <5.11 || >=5.15.153 <5.16 || >=6.1.83 <6.2 || >=6.6.23 <6.7 || >=6.7.11 <6.8 || >=6.8.2 <6.9 | 3ff45361e9469e85c0f86b8e7b82c63e50bab8ef, f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a, 5e9a94539b1ec17a89177d952badfd0d844d694a, 4.20, 5.5, 5.11, 5.16, 6.2, 6.7, 6.8, 6.9 |
| Linux/Linuxgeneric | 6.9 | Not reported |
| Linux/Linuxgeneric | >=3cfcfc102a5e57b021b786a755a38935e357797d <fb30241f7ccace372ee83017891549f23a715581 || >=3cfcfc102a5e57b021b786a755a38935e357797d <3ff45361e9469e85c0f86b8e7b82c63e50bab8ef || >=3cfcfc102a5e57b021b786a755a38935e357797d <f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a || >=3cfcfc102a5e57b021b786a755a38935e357797d <5e9a94539b1ec17a89177d952badfd0d844d694a || b97c37978ca825557d331c9012e0c1ddc0e42364 || bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8 || bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8 || dd292e884c649f9b1c18af0ec75ca90b390cd044 || 934212a623cbab851848b6de377eb476718c3e4c || 5e6013ae2c8d420faea553d363935f65badd32c3 || 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4 || 996997d1fb2126feda550d6adcedcbd94911fc69 || >=4.19.311 <4.20 || >=5.4.273 <5.5 || >=5.10.214 <5.11 || >=5.15.153 <5.16 || >=6.1.83 <6.2 || >=6.6.23 <6.7 || >=6.7.11 <6.8 || >=6.8.2 <6.9 | fb30241f7ccace372ee83017891549f23a715581, 3ff45361e9469e85c0f86b8e7b82c63e50bab8ef, f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a, 5e9a94539b1ec17a89177d952badfd0d844d694a, 4.20, 5.5, 5.11, 5.16, 6.2, 6.7, 6.8, 6.9 |
| Linux/Linuxgeneric | >=5e6013ae2c8d420faea553d363935f65badd32c3 <8c56a46db3b7523f13e167c3e2c6e3c47a87dcb3 || >=3cfcfc102a5e57b021b786a755a38935e357797d <fb30241f7ccace372ee83017891549f23a715581 || >=3cfcfc102a5e57b021b786a755a38935e357797d <3ff45361e9469e85c0f86b8e7b82c63e50bab8ef || >=3cfcfc102a5e57b021b786a755a38935e357797d <f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a || >=3cfcfc102a5e57b021b786a755a38935e357797d <5e9a94539b1ec17a89177d952badfd0d844d694a || b97c37978ca825557d331c9012e0c1ddc0e42364 || bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8 || bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8 || dd292e884c649f9b1c18af0ec75ca90b390cd044 || 934212a623cbab851848b6de377eb476718c3e4c || 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4 || 996997d1fb2126feda550d6adcedcbd94911fc69 || >=6.6.23 <6.6.160 || >=4.19.311 <4.20 || >=5.4.273 <5.5 || >=5.10.214 <5.11 || >=5.15.153 <5.16 || >=6.1.83 <6.2 || >=6.7.11 <6.8 || >=6.8.2 <6.9 | 8c56a46db3b7523f13e167c3e2c6e3c47a87dcb3, fb30241f7ccace372ee83017891549f23a715581, 3ff45361e9469e85c0f86b8e7b82c63e50bab8ef, f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a, 5e9a94539b1ec17a89177d952badfd0d844d694a, 6.6.160, 4.20, 5.5, 5.11, 5.16, 6.2, 6.8, 6.9 |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose. gssx_dec_option_array() sets oa->count = 1 before allocating oa->data. If that allocation fails, -ENOMEM is returned with oa->count == 1 and oa->data == NULL. All other error paths jump to free_oa: which frees oa->data and NULLs it but also leaves oa->count == 1. The caller trusts the count: gssp_accept_sec_context_upcall() gssx_dec_accept_sec_context() gssx_dec_option_array() /* fails, count=1 data=NULL */ data = res.options.data[0].value /* NULL deref */ Independently, free_creds: releases the partially decoded svc_cred with a bare kfree(creds). gssx_dec_linux_creds() installs a groups_alloc() result into creds->cr_group_info; that object is kvmalloc-backed and refcounted, and only put_group_info() reaches kvfree(). A plain kfree(creds) drops the wrapper and leaks the group_info allocation. The natural fix for the leak is to call free_svc_cred(creds) before kfree(creds), but free_svc_cred() invokes put_group_info() on creds->cr_group_info unconditionally when non-NULL. The existing out_free_groups: path in gssx_dec_linux_creds() already called groups_free() on that pointer without clearing it, so once free_svc_cred() is wired in, the subsequent put_group_info() would touch freed memory. Fix all four together: - Move the oa->count = 1 assignment below the oa->data allocation so it is never set when oa->data is NULL. - Reset oa->count to 0 at free_oa: so count and data stay coherent and the caller sees an empty option array. - Call free_svc_cred(creds) before kfree(creds) at free_creds: so the refcounted cr_group_info is released. free_svc_cred() either NULL-guards each field explicitly (cr_group_info has an if() check) or delegates to a helper that is NULL-safe itself (kfree for the string fields, gss_mech_put() which guards with if(gm) at gss_mech_switch.c:342), so it is safe to call on a partially decoded svc_cred where only cr_uid/cr_gid/cr_group_info have been written and everything else is zero from kzalloc. - In gssx_dec_linux_creds()'s out_free_groups: path, release cr_group_info with put_group_info() rather than groups_free() so the teardown matches free_svc_cred()'s refcount-aware path, and clear the pointer so a later free_svc_cred() on the same creds does not release it a second time.
Quoted source text, attributed separately from HOL analysis.