{"id":"AZL-100097","summary":"CVE-2026-89537 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n\ngss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags\nbyte at ptr[2], and padding at ptr[3..7], then passes\nptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().\nNone of these accesses check read_token-\u003elen first.\n\nThe minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus\nctx-\u003ekrb5e-\u003ecksum_len (12-24, depending on the enctype).  All callers\naccept shorter tokens from the wire:\n\n - gss_unwrap_resp_integ() enforces only an upper bound\n   (offset + len \u003c= rcv_buf-\u003elen) before allocating\n   mic.data = kmalloc(len) and passing it to gss_verify_mic().\n   A malicious NFS server can therefore supply a short checksum\n   opaque, producing a small slab allocation that the Kerberos MIC\n   verifier reads past.\n\n - gss_validate() enforces only len \u003c= RPC_MAX_AUTH_SIZE (400)\n   before passing the wire-supplied length to\n   gss_validate_seqno_mic(), which constructs a mic xdr_netobj\n   and calls gss_verify_mic().\n\n - svcauth_gss_verify_header() enforces only\n   checksum.len \u003e= XDR_UNIT (4 bytes) before dispatching to\n   gss_verify_mic().\n\n - svcauth_gss_unwrap_integ() checks only that the checksum fits\n   in gsd-\u003egsd_scratch.\n\nAdd a length guard at the top of gss_krb5_verify_mic_v2(), before any\nptr[] access or scatterlist construction.  Well-formed MIC tokens from\ngss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +\ncksum_len bytes, so valid traffic is unaffected.","modified":"2026-09-13T06:06:36Z","published":"2026-09-11T20:19:36Z","upstream":["CVE-2026-89537"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89537"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100097.json"}}],"schema_version":"1.9.0"}