CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: reject duplicate CREDSVALUE options

gssxdecoptionarray() walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds() on the same struct svccred. That helper unconditionally installs a fresh groupsalloc() result into creds->crgroupinfo without releasing whatever pointer was already there:

for (i = 0; i < count; i++) { ... decode name ... if (length == sizeof(CREDSVALUE) && memcmp(p, CREDSVALUE, sizeof(CREDSVALUE)) == 0) { err = gssxdeclinuxcreds(xdr, creds); ... } }

A reply that carries two CREDSVALUE entries therefore overwrites crgroupinfo on the second iteration and orphans the groupinfo allocated by the first call. The earlier freecreds path only releases the last crgroupinfo via freesvccred(), so the first allocation's refcount stays at one and its kvmalloc-backed storage is leaked. No in-tree caller of gsspacceptseccontextupcall() expects more than one CREDSVALUE per reply.

Fix by tracking whether a CREDSVALUE option has already been decoded and returning -EINVAL on any subsequent match, so the freecreds path releases the single groupinfo that was installed.

Affected Software

1 affected component
Linux Kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:44 PM
Data Sourced
via MITRE·07:44 PM
Description

Frequently Asked Questions

1

What input is required to trigger the leak?

The option array processed by gssx_dec_option_array() must contain two entries named CREDS_VALUE. Processing the second entry overwrites the existing cr_group_info pointer, leaving the first group_info allocation unreleased.

2

What is the observable impact of successful triggering?

The kernel leaks the first kvmalloc-backed group_info allocation because its reference count remains at one. The normal credential cleanup path frees only the most recently installed cr_group_info.

3

Will rejecting duplicate CREDS_VALUE options disrupt expected in-tree use?

No in-tree caller of gssp_accept_sec_context_upcall() expects more than one CREDS_VALUE option in a reply. The fix returns -EINVAL when a subsequent matching option is encountered.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203