CVE-2026-89537
moderateOut-of-bounds read in Linux kernel NFS Kerberos MIC token verification
The Linux kernel's RPCSEC_GSS Kerberos message-integrity verifier, gss_krb5_verify_mic_v2(), reads a 16-byte token header and a 12-24 byte checksum from the wire without first validating that the token is long enough. A malicious NFS server can send a truncated checksum blob to an NFS client using sec=krb5i or sec=krb5p, causing the kernel to read past the end of a small heap allocation; the server-side unwrap path (svcauth_gss_unwrap_integ) likewise lets a malicious client target an NFS server. Successful abuse can crash the kernel (denial of service) or expose kernel memory contents, but does not allow forging or modifying authenticated data. Any Linux system acting as an NFS client or server with Kerberos integrity or privacy enabled is affected; plain AUTH_SYS mounts are not on the vulnerable path. No public proof of concept exists and the flaw is not known to be exploited in the wild.
What to do: Apply your distribution's kernel updates containing this fix and reboot (or restart NFS/RPC services) once patched; specific fixed versions were not listed in this record. Until then, only mount NFS exports from trusted servers with sec=krb5i/krb5p, and restrict NFS server access to known clients. Watch for kernel oopses referencing gss_krb5_verify_mic_v2/gss_verify_mic as an indicator of probing.
| Linux kernel (SUNRPC / RPCSEC_GSS Kerberos MIC verification, gss_krb5_verify_mic_v2) | Affected version ranges not enumerated in this record; fixed by an upstream commit adding a length guard at the top of gss_krb5_verify_mic_v2() before any token |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first. The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus ctx->krb5e->cksum_len (12-24, depending on the enctype). All callers accept shorter tokens from the wire: - gss_unwrap_resp_integ() enforces only an upper bound (offset + len len) before allocating mic.data = kmalloc(len) and passing it to gss_verify_mic(). A malicious NFS server can therefore supply a short checksum opaque, producing a small slab allocation that the Kerberos MIC verifier reads past. - gss_validate() enforces only len = XDR_UNIT (4 bytes) before dispatching to gss_verify_mic(). - svcauth_gss_unwrap_integ() checks only that the checksum fits in gsd->gsd_scratch. Add a length guard at the top of gss_krb5_verify_mic_v2(), before any ptr[] access or scatterlist construction. Well-formed MIC tokens from gss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN + cksum_len bytes, so valid traffic is unaffected.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.