{"id":"CVE-2026-89537","summary":"SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n\ngss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags\nbyte at ptr[2], and padding at ptr[3..7], then passes\nptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().\nNone of these accesses check read_token-\u003elen first.\n\nThe minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus\nctx-\u003ekrb5e-\u003ecksum_len (12-24, depending on the enctype).  All callers\naccept shorter tokens from the wire:\n\n - gss_unwrap_resp_integ() enforces only an upper bound\n   (offset + len \u003c= rcv_buf-\u003elen) before allocating\n   mic.data = kmalloc(len) and passing it to gss_verify_mic().\n   A malicious NFS server can therefore supply a short checksum\n   opaque, producing a small slab allocation that the Kerberos MIC\n   verifier reads past.\n\n - gss_validate() enforces only len \u003c= RPC_MAX_AUTH_SIZE (400)\n   before passing the wire-supplied length to\n   gss_validate_seqno_mic(), which constructs a mic xdr_netobj\n   and calls gss_verify_mic().\n\n - svcauth_gss_verify_header() enforces only\n   checksum.len \u003e= XDR_UNIT (4 bytes) before dispatching to\n   gss_verify_mic().\n\n - svcauth_gss_unwrap_integ() checks only that the checksum fits\n   in gsd-\u003egsd_scratch.\n\nAdd a length guard at the top of gss_krb5_verify_mic_v2(), before any\nptr[] access or scatterlist construction.  Well-formed MIC tokens from\ngss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +\ncksum_len bytes, so valid traffic is unaffected.","modified":"2026-09-13T03:47:19.089040802Z","published":"2026-09-11T19:44:15.216Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89537.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89537.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89537"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"de9c17eb4a912c9028f7b470eb80815144883b26"},{"fixed":"7a946b2e7207f968902f2147ab9b30726f82f7ab"},{"fixed":"b94f6719dcd9f7a609bc5f459f85795900e77d25"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89537.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.35"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89537.json"}}],"schema_version":"1.9.0"}