PT-2026-90260 · Linux · Linux
CVE-2026-89544
·
Published
2026-09-11
·
Updated
2026-09-11
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: fix gssx dec option array error path bugs
Four coupled defects in the gssx XDR option-array decoder make the
error paths unsafe: a NULL deref in the caller, a refcount leak on
the decoded group info, and a latent use-after-free that the leak
fix would otherwise expose.
gssx dec option array() sets oa->count = 1 before allocating
oa->data. If that allocation fails, -ENOMEM is returned with
oa->count == 1 and oa->data == NULL. All other error paths jump
to free oa: which frees oa->data and NULLs it but also leaves
oa->count == 1. The caller trusts the count:
gssp accept sec context upcall()
gssx dec accept sec context()
gssx dec option array() /* fails, count=1 data=NULL /
data = res.options.data[0].value / NULL deref */
Independently, free creds: releases the partially decoded svc cred
with a bare kfree(creds). gssx dec linux creds() installs a
groups alloc() result into creds->cr group info; that object is
kvmalloc-backed and refcounted, and only put group info() reaches
kvfree(). A plain kfree(creds) drops the wrapper and leaks the
group info allocation.
The natural fix for the leak is to call free svc cred(creds) before
kfree(creds), but free svc cred() invokes put group info() on
creds->cr group info unconditionally when non-NULL. The existing
out free groups: path in gssx dec linux creds() already called
groups free() on that pointer without clearing it, so once
free svc cred() is wired in, the subsequent put group info() would
touch freed memory.
Fix all four together:
- Move the oa->count = 1 assignment below the oa->data allocation so it is never set when oa->data is NULL.
- Reset oa->count to 0 at free oa: so count and data stay coherent and the caller sees an empty option array.
- Call free svc cred(creds) before kfree(creds) at free creds: so the refcounted cr group info is released. free svc cred() either NULL-guards each field explicitly (cr group info has an if() check) or delegates to a helper that is NULL-safe itself (kfree for the string fields, gss mech put() which guards with if(gm) at gss mech switch.c:342), so it is safe to call on a partially decoded svc cred where only cr uid/cr gid/cr group info have been written and everything else is zero from kzalloc.
- In gssx dec linux creds()'s out free groups: path, release cr group info with put group info() rather than groups free() so the teardown matches free svc cred()'s refcount-aware path, and clear the pointer so a later free svc cred() on the same creds does not release it a second time.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux