CVE-2026-89544

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-89544

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89544.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-89544

Downstream

AZL (1)

AZL-100656

BELL (1)

BELL-CVE-2026-89544

CLSA (1)

CLSA-2026-1792419819

DEBIAN (1)

DEBIAN-CVE-2026-89544

openSUSE (2)

SUSE (12)

UBUNTU (1)

UBUNTU-CVE-2026-89544

Related

openSUSE (2)

SUSE (12)

Published

2026-09-11T19:44:20Z

Modified

2026-10-24T02:30:22Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

SUNRPC: fix gssx_dec_option_array error path bugs

Details

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: fix gssx_dec_option_array error path bugs

Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose.

gssx_dec_option_array() sets oa->count = 1 before allocating oa->data. If that allocation fails, -ENOMEM is returned with oa->count == 1 and oa->data == NULL. All other error paths jump to free_oa: which frees oa->data and NULLs it but also leaves oa->count == 1. The caller trusts the count:

gssp_accept_sec_context_upcall()
  gssx_dec_accept_sec_context()
    gssx_dec_option_array()        /* fails, count=1 data=NULL */
  data = res.options.data[0].value /* NULL deref */

Independently, free_creds: releases the partially decoded svc_cred with a bare kfree(creds). gssx_dec_linux_creds() installs a groups_alloc() result into creds->cr_group_info; that object is kvmalloc-backed and refcounted, and only put_group_info() reaches kvfree(). A plain kfree(creds) drops the wrapper and leaks the group_info allocation.

The natural fix for the leak is to call free_svc_cred(creds) before kfree(creds), but free_svc_cred() invokes put_group_info() on creds->cr_group_info unconditionally when non-NULL. The existing out_free_groups: path in gssx_dec_linux_creds() already called groups_free() on that pointer without clearing it, so once free_svc_cred() is wired in, the subsequent put_group_info() would touch freed memory.

Fix all four together:

Move the oa->count = 1 assignment below the oa->data allocation so it is never set when oa->data is NULL.
Reset oa->count to 0 at free_oa: so count and data stay coherent and the caller sees an empty option array.
Call free_svc_cred(creds) before kfree(creds) at free_creds: so the refcounted cr_group_info is released. free_svc_cred() either NULL-guards each field explicitly (cr_group_info has an if() check) or delegates to a helper that is NULL-safe itself (kfree for the string fields, gss_mech_put() which guards with if(gm) at gss_mech_switch.c:342), so it is safe to call on a partially decoded svc_cred where only cr_uid/cr_gid/cr_group_info have been written and everything else is zero from kzalloc.
In gssx_dec_linux_creds()'s out_free_groups: path, release cr_group_info with put_group_info() rather than groups_free() so the teardown matches free_svc_cred()'s refcount-aware path, and clear the pointer so a later free_svc_cred() on the same creds does not release it a second time.

Database specific

{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89544.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5e6013ae2c8d420faea553d363935f65badd32c3

Fixed

8c56a46db3b7523f13e167c3e2c6e3c47a87dcb3

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

3cfcfc102a5e57b021b786a755a38935e357797d

Fixed

fb30241f7ccace372ee83017891549f23a715581

Fixed

3ff45361e9469e85c0f86b8e7b82c63e50bab8ef

Fixed

f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a

Fixed

5e9a94539b1ec17a89177d952badfd0d844d694a

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.6.23

Fixed

6.6.160

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

4.19.311

Fixed

4.20

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.4.273

Fixed

5.5

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.10.214

Fixed

5.11

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.15.153

Fixed

5.16

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.1.83

Fixed

6.2

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.7.11

Fixed

6.8

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.8.2

Fixed

6.9

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

b97c37978ca825557d331c9012e0c1ddc0e42364

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

dd292e884c649f9b1c18af0ec75ca90b390cd044

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

934212a623cbab851848b6de377eb476718c3e4c

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

996997d1fb2126feda550d6adcedcbd94911fc69

Affected versions

v4.*

v4.19.311

v4.19.312

v4.19.313

v4.19.314

v4.19.315

v4.19.316

v4.19.317

v4.19.318

v4.19.319

v4.19.320

v4.19.321

v4.19.322

v4.19.323

v4.19.324

v4.19.325

v5.*

v5.10.214

v5.10.215

v5.10.216

v5.10.217

v5.10.218

v5.10.219

v5.10.220

v5.10.221

v5.10.222

v5.10.223

v5.10.224

v5.10.225

v5.10.226

v5.10.227

v5.10.228

v5.10.229

v5.10.230

v5.10.231

v5.10.232

v5.10.233

v5.10.234

v5.10.235

v5.10.236

v5.10.237

v5.10.238

v5.10.239

v5.10.240

v5.10.241

v5.10.242

v5.10.243

v5.10.244

v5.10.245

v5.10.246

v5.10.247

v5.10.248

v5.10.249

v5.10.250

v5.10.251

v5.10.252

v5.10.253

v5.10.254

v5.10.255

v5.10.256

v5.10.257

v5.10.258

v5.10.259

v5.10.260

v5.10.261

v5.10.262

v5.10.263

v5.10.264

v5.10.265

v5.10.266

v5.10.267

v5.10.268

v5.10.269

v5.10.270

v5.10.271

v5.10.272

v5.15.153

v5.15.154

v5.15.155

v5.15.156

v5.15.157

v5.15.158

v5.15.159

v5.15.160

v5.15.161

v5.15.162

v5.15.163

v5.15.164

v5.15.165

v5.15.166

v5.15.167

v5.15.168

v5.15.169

v5.15.170

v5.15.171

v5.15.172

v5.15.173

v5.15.174

v5.15.175

v5.15.176

v5.15.177

v5.15.178

v5.15.179

v5.15.180

v5.15.181

v5.15.182

v5.15.183

v5.15.184

v5.15.185

v5.15.186

v5.15.187

v5.15.188

v5.15.189

v5.15.190

v5.15.191

v5.15.192

v5.15.193

v5.15.194

v5.15.195

v5.15.196

v5.15.197

v5.15.198

v5.15.199

v5.15.200

v5.15.201

v5.15.202

v5.15.203

v5.15.204

v5.15.205

v5.15.206

v5.15.207

v5.15.208

v5.15.209

v5.15.210

v5.15.211

v5.15.212

v5.15.213

v5.15.214

v5.15.215

v5.15.216

v5.15.217

v5.15.218

v5.15.219

v5.15.220

v5.15.221

v5.15.222

v5.15.223

v5.4.273

v5.4.274

v5.4.275

v5.4.276

v5.4.277

v5.4.278

v5.4.279

v5.4.280

v5.4.281

v5.4.282

v5.4.283

v5.4.284

v5.4.285

v5.4.286

v5.4.287

v5.4.288

v5.4.289

v5.4.290

v5.4.291

v5.4.292

v5.4.293

v5.4.294

v5.4.295

v5.4.296

v5.4.297

v5.4.298

v5.4.299

v5.4.300

v5.4.301

v5.4.302

v6.*

v6.1.100

v6.1.101

v6.1.102

v6.1.103

v6.1.104

v6.1.105

v6.1.106

v6.1.107

v6.1.108

v6.1.109

v6.1.110

v6.1.111

v6.1.112

v6.1.113

v6.1.114

v6.1.115

v6.1.116

v6.1.117

v6.1.118

v6.1.119

v6.1.120

v6.1.121

v6.1.122

v6.1.123

v6.1.124

v6.1.125

v6.1.126

v6.1.127

v6.1.128

v6.1.129

v6.1.130

v6.1.131

v6.1.132

v6.1.133

v6.1.134

v6.1.135

v6.1.136

v6.1.137

v6.1.138

v6.1.139

v6.1.140

v6.1.141

v6.1.142

v6.1.143

v6.1.144

v6.1.145

v6.1.146

v6.1.147

v6.1.148

v6.1.149

v6.1.150

v6.1.151

v6.1.152

v6.1.153

v6.1.154

v6.1.155

v6.1.156

v6.1.157

v6.1.158

v6.1.159

v6.1.160

v6.1.161

v6.1.162

v6.1.163

v6.1.164

v6.1.165

v6.1.166

v6.1.167

v6.1.168

v6.1.169

v6.1.170

v6.1.171

v6.1.172

v6.1.173

v6.1.174

v6.1.175

v6.1.176

v6.1.177

v6.1.178

v6.1.179

v6.1.180

v6.1.181

v6.1.182

v6.1.183

v6.1.184

v6.1.185

v6.1.186

v6.1.187

v6.1.188

v6.1.189

v6.1.190

v6.1.83

v6.1.84

v6.1.85

v6.1.86

v6.1.87

v6.1.88

v6.1.89

v6.1.90

v6.1.91

v6.1.92

v6.1.93

v6.1.94

v6.1.95

v6.1.96

v6.1.97

v6.1.98

v6.1.99

v6.6.100

v6.6.101

v6.6.102

v6.6.103

v6.6.104

v6.6.105

v6.6.106

v6.6.107

v6.6.108

v6.6.109

v6.6.110

v6.6.111

v6.6.112

v6.6.113

v6.6.114

v6.6.115

v6.6.116

v6.6.117

v6.6.118

v6.6.119

v6.6.120

v6.6.121

v6.6.122

v6.6.123

v6.6.124

v6.6.125

v6.6.126

v6.6.127

v6.6.128

v6.6.129

v6.6.130

v6.6.131

v6.6.132

v6.6.133

v6.6.134

v6.6.135

v6.6.136

v6.6.137

v6.6.138

v6.6.139

v6.6.140

v6.6.141

v6.6.142

v6.6.143

v6.6.144

v6.6.145

v6.6.146

v6.6.147

v6.6.148

v6.6.149

v6.6.150

v6.6.151

v6.6.152

v6.6.153

v6.6.154

v6.6.155

v6.6.156

v6.6.157

v6.6.158

v6.6.159

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.30

v6.6.31

v6.6.32

v6.6.33

v6.6.34

v6.6.35

v6.6.36

v6.6.37

v6.6.38

v6.6.39

v6.6.40

v6.6.41

v6.6.42

v6.6.43

v6.6.44

v6.6.45

v6.6.46

v6.6.47

v6.6.48

v6.6.49

v6.6.50

v6.6.51

v6.6.52

v6.6.53

v6.6.54

v6.6.55

v6.6.56

v6.6.57

v6.6.58

v6.6.59

v6.6.60

v6.6.61

v6.6.62

v6.6.63

v6.6.64

v6.6.65

v6.6.66

v6.6.67

v6.6.68

v6.6.69

v6.6.70

v6.6.71

v6.6.72

v6.6.73

v6.6.74

v6.6.75

v6.6.76

v6.6.77

v6.6.78

v6.6.79

v6.6.80

v6.6.81

v6.6.82

v6.6.83

v6.6.84

v6.6.85

v6.6.86

v6.6.87

v6.6.88

v6.6.89

v6.6.90

v6.6.91

v6.6.92

v6.6.93

v6.6.94

v6.6.95

v6.6.96

v6.6.97

v6.6.98

v6.6.99

v6.7.11

v6.7.12

v6.8.10

v6.8.11

v6.8.12

v6.8.2

v6.8.3

v6.8.4

v6.8.5

v6.8.6

v6.8.7

v6.8.8

v6.8.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89544.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.6.160

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.111

Type: ECOSYSTEM
Events: Introduced

6.9.0

Fixed

6.18.51

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

7.2.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89544.json"