CVE-2026-93207

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SUNRPC component where the svcauth gss decode credbody() function fails to properly initialize the rpc gss wire cred field. Because the storage svcdata->clcred is reused across requests, early decoding failures can leave a partially decoded state mixed with residue from previous requests. Specifically, when a body len tightness check fails, the gc ctx.data may contain a borrowed inline pointer to XDR pages that are subsequently released, while gc ctx.len retains a stale value. This results in a dangling pointer paired with an incorrect length, which can be exploited by length-driven consumers such as the gss svc searchbyctx() function to access invalid memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.