CVE-2026-89537

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SUNRPC component where the gss krb5 verify mic v2() function fails to verify the length of the read token->len before accessing the token ID, flags byte, and padding. This lack of validation allows a malicious NFS server to provide a short checksum opaque, leading to a small slab allocation that the Kerberos MIC verifier reads past. The vulnerability is triggered because several callers, including gss unwrap resp integ(), gss validate(), svcauth gss verify header(), and svcauth gss unwrap integ(), do not sufficiently enforce the minimum safe token size, which consists of the header length plus the checksum length.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.