UBUNTU-CVE-2026-93207: Critical severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody() entry svcauthgssdecodecredbody() writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata->clcred, which lives in the per-svcrqst gsssvcdata and is reused across requests. Early decode failures leave partially decoded state mixed with residue from the prior request. The trailing bodylen tightness check is the sharpest case: xdrstreamdecodeopaqueinline() has already written gcctx.data with a borrowed inline pointer into the current request's XDR pages, but gcctx.len retains its prior value. Once the request pages are released the pooled clcred carries a dangling pointer paired with a stale length. Zero the caller's rpcgsswirecred at function entry so that every early-return path leaves a deterministic all-zero cred. On the trailing tightness-check path, gcctx.len is now zero instead of stale, which neuters length-driven consumers such as gsssvcsearchbyctx() that would otherwise walk the dangling data pointer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Zero the caller's rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry so every early-return path leaves a deterministic all-zero credential.
Linux kernel SUNRPC rpc_gss_wire_cred initialization in svcauth_gss_decode_credbody() = zero at function entry
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the affected Ubuntu kernel packages listed in the advisory are exposed where the kernel's SUNRPC RPCSEC_GSS server-side credential decoding is reachable. The issue is in reused per-request GSS credential state during handling of malformed requests.
What does an attacker need to do to trigger the vulnerable path?
An attacker must be able to send a malformed RPCSEC_GSS request that causes credential decoding to fail after partial state has been written, including the trailing body-length tightness-check path. No privileges or user interaction are indicated by the supplied severity vector.
Why can a malformed request affect later requests?
The credential storage is reused across requests. An early decoding failure can leave a borrowed pointer from the failed request combined with a stale length from a prior request; after the request pages are released, later length-driven processing can use that dangling pointer.
What does the fix change?
The fix clears the caller's rpc_gss_wire_cred structure when credential decoding begins. This makes all early failure paths leave zeroed credential data, including a zero context length, rather than retaining state from an earlier request.