CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: harden gsskrb5unwrapv2 against short tokens
gsskrb5unwrapv2() reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN (16) bytes long, and its rotateleft() helper passes buf->len - base to xdrbufsubsegment() without verifying that base <= buf->len. When a caller hands in a sub-16-byte token, or a token whose declared len leaves base past the end of the buffer, three distinct failures follow:
gsskrb5unwrapv2(offset, len, buf) ptr = buf->head[0].iovbase + offset ec = (ptr + 4) / OOB read on short head / rrc = (ptr + 6) / OOB read on short head / rotateleft(offset + 16, buf, rrc) xdrbufsubsegment(buf, &subbuf, base, buf->len - base) / u32 wrap when base > len / rotateleft(&subbuf, shift) shift %= buf->len / divide-by-zero when base == len /
After decryption, the cleanup arithmetic has the same shape:
movelen = mint(unsigned int, buf->head[0].iovlen, len); movelen -= offset + GSSKRB5TOKHDRLEN + headskip; BUGON(offset + GSSKRB5TOKHDRLEN + headskip + movelen > buf->head[0].iovlen);
The BUGON re-adds the value just subtracted, so it reduces to min(A, B) > A and is permanently false; it cannot catch the unsigned underflow of movelen, which then drives a ~UINTMAX-byte memmove().
Add four defense-in-depth guards inside the unwrap core so it is safe regardless of what its callers validate:
- reject tokens with len - offset < GSSKRB5TOKHDRLEN before touching ptr+4/ptr+6; - bail from rotateleft() when buf->len <= base, covering both the underflow and zero-length cases; - return early from rotateleft() when buf->len is zero, so the shift %= buf->len modulo cannot fault; - replace the dead BUGON with a live check that returns GSSSDEFECTIVETOKEN before the movelen subtraction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the upstream kernel fix for the Linux kernel vulnerability “SUNRPC: harden gss_krb5_unwrap_v2 against short tokens” to prevent crashes/OOB reads when gss_krb5_unwrap_v2 is invoked with short/underflowing token lengths.
Event History
Frequently Asked Questions
What inputs can trigger the vulnerable paths?
A token shorter than 16 bytes can cause out-of-bounds reads of the EC and RRC fields. A token whose declared length causes the rotation base to exceed the buffer length can also trigger unsigned-length wrapping or a divide-by-zero condition.
What kinds of failures can result from malformed tokens?
The described failures include out-of-bounds reads, an unsigned 32-bit length wrap passed to xdr_buf_subsegment(), and a divide-by-zero when the rotation base equals the buffer length. Cleanup arithmetic after decryption can also reach a BUG_ON condition.
Which deployments should be reviewed?
Review Linux kernel systems using SUNRPC Kerberos v5 token unwrapping paths that can pass externally supplied or otherwise malformed tokens to gss_krb5_unwrap_v2(). The provided information does not identify affected kernel versions or configuration defaults.