SB20260912250 - Improper input validation in Linux kernel sunrpc auth_gss

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-89538)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in gss_krb5_unwrap_v2() when processing Kerberos v2 wrap tokens with oversized extra count fields. A remote user can send a malformed Kerberos v2 wrap token to cause a denial of service.

The token must be encrypted using a valid GSS context.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1f9856af065b6158271687e9788407b9573fd16f
• https://git.kernel.org/stable/c/880effc943ed82d6811f272ed3307c222b40f4d6
• https://git.kernel.org/stable/c/ad484748eec0a66eac0f13ab53b3fbedb7333c91
• https://git.kernel.org/stable/c/dfcd81ab45613d45996fbf483d4ef54b0ec90ab9