UBUNTU-CVE-2026-89539: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray() walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds() on the same struct svccred. That helper unconditionally installs a fresh groupsalloc() result into creds->crgroupinfo without releasing whatever pointer was already there: for (i = 0; i < count; i++) { ... decode name ... if (length == sizeof(CREDSVALUE) && memcmp(p, CREDSVALUE, sizeof(CREDSVALUE)) == 0) { err = gssxdeclinuxcreds(xdr, creds); ... } } A reply that carries two CREDSVALUE entries therefore overwrites crgroupinfo on the second iteration and orphans the groupinfo allocated by the first call. The earlier freecreds path only releases the last crgroupinfo via freesvccred(), so the first allocation's refcount stays at one and its kvmalloc-backed storage is leaked. No in-tree caller of gsspacceptseccontextupcall() expects more than one CREDSVALUE per reply. Fix by tracking whether a CREDSVALUE option has already been decoded and returning -EINVAL on any subsequent match, so the freecreds path releases the single groupinfo that was installed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Modify gssx_dec_option_array() to track whether a CREDS_VALUE option has already been decoded and return -EINVAL when a subsequent CREDS_VALUE entry is encountered, ensuring only one group_info is installed for the free_creds path.