CVE-2026-89539

CVE CVE-2026-89539EUVD EUVD-2026-76450Published 2026-09-11T19:44:16.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDS_VALUE options gssx_dec_option_array() walks the wire-supplied option array and, for every entry whose name matches CREDS_VALUE, calls gssx_dec_linux_creds() on the same struct svc_cred. That helper unconditionally installs a fresh groups_alloc() result into creds->cr_group_info without releasing whatever pointer was already there: for (i = 0; i < count; i++) { ... decode name ... if (length == sizeof(CREDS_VALUE) && memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) { err = gssx_dec_linux_creds(xdr, creds); ... } } A reply that carries two CREDS_VALUE entries therefore overwrites cr_group_info on the second iteration and orphans the group_info allocated by the first call. The earlier free_creds path only releases the last cr_group_info via free_svc_cred(), so the first allocation's refcount stays at one and its kvmalloc-backed storage is leaked. No in-tree caller of gssp_accept_sec_context_upcall() expects more than one CREDS_VALUE per reply. Fix by tracking whether a CREDS_VALUE option has already been decoded and returning -EINVAL on any subsequent match, so the free_creds path releases the single group_info that was installed.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 7.2.4; 1d658336b05f8697d6445834f8867f8ad5e4f735 <2e4ce62385c1b8a887c5370af058ac7b52a8eaf9; 3.10; 1d658336b05f8697d6445834f8867f8ad5e4f735 <f615b884310bf82d0014e3b5a92eb9aa88146685; patch: 0; patch: 7.3-rc1; patch: 6.12.109; 1d658336b05f8697d6445834f8867f8ad5e4f735 <9d94f046b23de0f77849ea69133063c949297e30; 1d658336b05f8697d6445834f8867f8ad5e4f735 <7a1d0501cbb962beba23377035d667bf3c1726ee; patch: 6.18.50

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.