CVE-2026-93207

Received Received - Intake

Linux Kernel SUNRPC Credential Handling Flaw

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail. The caller storage is svcdata->clcred, which lives in the per-svc_rqst gss_svc_data and is reused across requests. Early decode failures leave partially decoded state mixed with residue from the prior request. The trailing body_len tightness check is the sharpest case: xdr_stream_decode_opaque_inline() has already written gc_ctx.data with a borrowed inline pointer into the current request's XDR pages, but gc_ctx.len retains its prior value. Once the request pages are released the pooled clcred carries a dangling pointer paired with a stale length. Zero the caller's rpc_gss_wire_cred at function entry so that every early-return path leaves a deterministic all-zero cred. On the trailing tightness-check path, gc_ctx.len is now zero instead of stale, which neuters length-driven consumers such as gss_svc_searchbyctx() that would otherwise walk the dangling data pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-93207

EUVD

EUVD-2026-85936

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory safety issue in the SUNRPC subsystem. The function svcauth_gss_decode_credbody() writes to the rpc_gss_wire_cred structure field by field without fully initializing it. If an error occurs during decoding, the structure retains partially written data mixed with remnants from previous requests. This can lead to dangling pointers and stale data being used in subsequent operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's SUNRPC subsystem and requires kernel-level inspection. Detection involves checking kernel logs for RPC-related errors or examining kernel memory for stale pointers in rpc_gss_wire_cred structures. Commands like dmesg, journalctl, or kernel debugging tools (e.g., crash, kgdb) may help identify issues. However, no direct user-space commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to cause memory corruption or unexpected behavior in the Linux kernel's SUNRPC subsystem. It may lead to crashes, data corruption, or privilege escalation if exploited. Systems using SUNRPC with GSS authentication could be particularly affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory handling issue in SUNRPC authentication. Compliance impacts would only occur if this flaw led to data exposure or integrity issues, which is not described in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Monitor vendor advisories for updates to your distribution. If immediate patching is not possible, restrict access to RPC services or disable SUNRPC features until patched. Reboot the system after applying fixes to ensure changes take effect.

Hi! I’m here to help you understand CVE-2026-93207. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70