CVE-2026-89550

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SUNRPC component where the svcauth gss unwrap priv() function only validates the upper bound of the wire-supplied opaque length len before passing the buffer to gss unwrap(). In krb5 v2 contexts, this allows tokens with a length between 0 and 16 to reach gss krb5 unwrap v2(). Because the function reads RFC 4121 token header fields and calls rotate left() before performing an integrity check, a truncated token or a header-only token can cause buf->len to be zero. This leads to a division by zero error during the shift %= buf->len operation within the rotate left() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.