CVE-2026-89539

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: reject duplicate CREDS VALUE options

gssx dec option array() walks the wire-supplied option array and, for every entry whose name matches CREDS VALUE, calls gssx dec linux creds() on the same struct svc cred. That helper unconditionally installs a fresh groups alloc() result into creds->cr group info without releasing whatever pointer was already there:

for (i = 0; i < count; i++) { ... decode name ... if (length == sizeof(CREDS VALUE) && memcmp(p, CREDS VALUE, sizeof(CREDS VALUE)) == 0) { err = gssx dec linux creds(xdr, creds); ... } }

A reply that carries two CREDS VALUE entries therefore overwrites cr group info on the second iteration and orphans the group info allocated by the first call. The earlier free creds path only releases the last cr group info via free svc cred(), so the first allocation's refcount stays at one and its kvmalloc-backed storage is leaked. No in-tree caller of gssp accept sec context upcall() expects more than one CREDS VALUE per reply.

Fix by tracking whether a CREDS VALUE option has already been decoded and returning -EINVAL on any subsequent match, so the free creds path releases the single group info that was installed.