CVE-2026-89551 (GCVE-0-2026-89551)
Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-10-19 08:48
VLAI
EPSS
VEX
Title
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
Summary
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by
walking the tail, pages, and head iovecs. Each per-section step
uses min_t() so it never removes more bytes than that section
holds, but the final accounting at the fix_len label subtracts the
total bytes actually consumed from buf->len without any clamp:
fix_len:
buf->len -= (len - trim);
When the caller has set buf->len to a value smaller than the sum
of the iov_lens, (len - trim) can exceed buf->len and the unsigned
subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches
xdr_buf_trim() in exactly that state:
buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
buf->len is a small wire-derived value while the iov_lens are at
page scale, so the per-section loops legitimately consume far more
bytes than buf->len records. The wrapped buf->len then propagates
as the authoritative stream bound into every downstream XDR
decoder.
Fix by clamping the decrement so buf->len bottoms out at zero:
buf->len -= min_t(unsigned int, buf->len, len - trim);
On the normal path where the iov_lens sum to buf->len, (len - trim)
is always <= buf->len and the result is identical to before. No
callers change behavior outside the underflow case.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:23 UTC
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
4c190e2f913f038c9c91ee63b59cd037260ba353 , < a3d77bcd974b8625d16bddf448cb3a1b5e37049c
(git)
Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < fa16bbe987b47e771e52eeb1b4540f18d92496ac (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < a924ac4c78afab71bf82641afa3b62e0c4a8b55e (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < e6267cccd7b05cc514e57f2160aa8db85f5c2701 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < ad0cce80d4af2f74674e8b635d97aa3880e83da8 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 85e9602650e9df07190abe817cee3b4d9bc3df17 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 3f491306dcb673ff5e78e1044ba450c58978774e (git) |
guessed | |
| Linux | Linux |
Affected:
3.9
Unaffected: 0 , < 3.9 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:23:51.789342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:43.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3d77bcd974b8625d16bddf448cb3a1b5e37049c",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "fa16bbe987b47e771e52eeb1b4540f18d92496ac",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "a924ac4c78afab71bf82641afa3b62e0c4a8b55e",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs. Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n fix_len:\n buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records. The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before. No\ncallers change behavior outside the underflow case."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - xdr_buf_trim() is reached from nfsd RPCSEC_GSS privacy unwrap on TCP/2049 (svcauth_gss_unwrap_priv \u2192 gss_unwrap \u2192 gss_krb5_unwrap_v2) and from the NFS client\u0027s gss_unwrap_resp_priv() on every krb5p reply, so a remote NFS peer delivers the wrap token over the network.\nAC:L - A peer holding the GSS session keys can encrypt a RFC 4121 wrap token so that after decrypt, buf-\u003elen is a small wire-derived value while iov_lens remain page-scale; xdr_buf_trim() then subtracts more than buf-\u003elen and wraps, with no race or layout outside attacker control.\nPR:N - A malicious or compromised NFS server that already shares a krb5p GSS context needs no account or capability on the victim client; ordinary krb5p replies and NFSv4.0 GSS callbacks are processed without local privileges on that host.\nUI:N - Once a krb5p NFS mount exists, the client unwraps every privacy-protected reply and NFSv4.0 GSS callback with no further mount, click, or open; idle revalidations and server-driven callbacks are sufficient.\nS:U - The wrapped buf-\u003elen and subsequent XDR decode run in the host kernel that processed the RPC and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed buf-\u003elen (~UINT_MAX) becomes the authoritative stream bound, and on nfsd xdr-\u003enwords also underflows via saved_len - buf-\u003elen, so later xdr_read_pages/xdr_shrink_bufhead and NFS XDR decoders read far past the receive buffer into adjacent kernel memory.\nI:H - xdr_shrink_bufhead() calls xdr_buf_head_shift_right() with a near-UINT_MAX length derived from the wrapped buf-\u003elen, and garbage xdr_stream_pos values can index the svc pages[] array out of bounds, an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Those unbounded XDR copies and the inconsistent xdr_buf (wrapped length versus iov_lens) oops or panic nfsd or the NFS client, and the peer can repeat the request at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:48:44.059Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c"
},
{
"url": "https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac"
},
{
"url": "https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e"
},
{
"url": "https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4"
},
{
"url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
},
{
"url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
},
{
"url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
},
{
"url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
}
],
"title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89551",
"datePublished": "2026-09-11T19:44:25.327Z",
"dateReserved": "2026-09-11T19:38:34.723Z",
"dateUpdated": "2026-10-19T08:48:44.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-89551",
"date": "2026-11-01",
"epss": "0.00514",
"percentile": "0.43831"
},
"microsoft_vex": {
"current_release_date": "2026-09-25T02:15:17.000Z",
"cve": "CVE-2026-89551",
"id": "msrc_CVE-2026-89551",
"initial_release_date": "2026-09-13T01:13:20.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89551.json",
"version": "5"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3d77bcd974b8625d16bddf448cb3a1b5e37049c",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "fa16bbe987b47e771e52eeb1b4540f18d92496ac",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "a924ac4c78afab71bf82641afa3b62e0c4a8b55e",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs. Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n fix_len:\n buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records. The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before. No\ncallers change behavior outside the underflow case."
}
],
"id": "CVE-2026-89551",
"lastModified": "2026-10-19T09:17:50.393",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-89551",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:23:51.789342Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-11T20:19:38.640",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-30T07:04:59+00:00",
"cve": "CVE-2026-89551",
"id": "CVE-2026-89551",
"initial_release_date": "2026-09-11T00:00:00+00:00",
"product_status:known_affected": "279",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89551.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:23:51.789342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:23:52.353Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3d77bcd974b8625d16bddf448cb3a1b5e37049c",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "fa16bbe987b47e771e52eeb1b4540f18d92496ac",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "a924ac4c78afab71bf82641afa3b62e0c4a8b55e",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
},
{
"lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
"status": "affected",
"version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs. Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n fix_len:\n buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records. The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before. No\ncallers change behavior outside the underflow case."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - xdr_buf_trim() is reached from nfsd RPCSEC_GSS privacy unwrap on TCP/2049 (svcauth_gss_unwrap_priv \u2192 gss_unwrap \u2192 gss_krb5_unwrap_v2) and from the NFS client\u0027s gss_unwrap_resp_priv() on every krb5p reply, so a remote NFS peer delivers the wrap token over the network.\nAC:L - A peer holding the GSS session keys can encrypt a RFC 4121 wrap token so that after decrypt, buf-\u003elen is a small wire-derived value while iov_lens remain page-scale; xdr_buf_trim() then subtracts more than buf-\u003elen and wraps, with no race or layout outside attacker control.\nPR:N - A malicious or compromised NFS server that already shares a krb5p GSS context needs no account or capability on the victim client; ordinary krb5p replies and NFSv4.0 GSS callbacks are processed without local privileges on that host.\nUI:N - Once a krb5p NFS mount exists, the client unwraps every privacy-protected reply and NFSv4.0 GSS callback with no further mount, click, or open; idle revalidations and server-driven callbacks are sufficient.\nS:U - The wrapped buf-\u003elen and subsequent XDR decode run in the host kernel that processed the RPC and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed buf-\u003elen (~UINT_MAX) becomes the authoritative stream bound, and on nfsd xdr-\u003enwords also underflows via saved_len - buf-\u003elen, so later xdr_read_pages/xdr_shrink_bufhead and NFS XDR decoders read far past the receive buffer into adjacent kernel memory.\nI:H - xdr_shrink_bufhead() calls xdr_buf_head_shift_right() with a near-UINT_MAX length derived from the wrapped buf-\u003elen, and garbage xdr_stream_pos values can index the svc pages[] array out of bounds, an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Those unbounded XDR copies and the inconsistent xdr_buf (wrapped length versus iov_lens) oops or panic nfsd or the NFS client, and the peer can repeat the request at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:48:44.059Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c"
},
{
"url": "https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac"
},
{
"url": "https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e"
},
{
"url": "https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4"
},
{
"url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
},
{
"url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
},
{
"url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
},
{
"url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
}
],
"title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89551",
"datePublished": "2026-09-11T19:44:25.327Z",
"dateReserved": "2026-09-11T19:38:34.723Z",
"dateUpdated": "2026-10-19T08:48:44.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.