CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: reject duplicate CREDSVALUE options
gssxdecoptionarray() walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds() on the same struct svccred. That helper unconditionally installs a fresh groupsalloc() result into creds->crgroupinfo without releasing whatever pointer was already there:
for (i = 0; i < count; i++) { ... decode name ... if (length == sizeof(CREDSVALUE) && memcmp(p, CREDSVALUE, sizeof(CREDSVALUE)) == 0) { err = gssxdeclinuxcreds(xdr, creds); ... } }
A reply that carries two CREDSVALUE entries therefore overwrites crgroupinfo on the second iteration and orphans the groupinfo allocated by the first call. The earlier freecreds path only releases the last crgroupinfo via freesvccred(), so the first allocation's refcount stays at one and its kvmalloc-backed storage is leaked. No in-tree caller of gsspacceptseccontextupcall() expects more than one CREDSVALUE per reply.
Fix by tracking whether a CREDSVALUE option has already been decoded and returning -EINVAL on any subsequent match, so the freecreds path releases the single groupinfo that was installed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In SUNRPC gssx_dec_option_array(), track whether a CREDS_VALUE option has already been decoded and return -EINVAL on any subsequent CREDS_VALUE match, preventing duplicate decoding and ensuring free_creds releases the single installed group_info.
Event History
Frequently Asked Questions
What input is required to trigger the leak?
The option array processed by gssx_dec_option_array() must contain two entries named CREDS_VALUE. Processing the second entry overwrites the existing cr_group_info pointer, leaving the first group_info allocation unreleased.
What is the observable impact of successful triggering?
The kernel leaks the first kvmalloc-backed group_info allocation because its reference count remains at one. The normal credential cleanup path frees only the most recently installed cr_group_info.
Will rejecting duplicate CREDS_VALUE options disrupt expected in-tree use?
No in-tree caller of gssp_accept_sec_context_upcall() expects more than one CREDS_VALUE option in a reply. The fix returns -EINVAL when a subsequent matching option is encountered.