Vulnerability-Lookup

CVE-2026-89551 (GCVE-0-2026-89551)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-10-19 08:48

Title

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Summary

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp: fix_len: buf->len -= (len - trim); When the caller has set buf->len to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf->len and the unsigned subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches xdr_buf_trim() in exactly that state: buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip); xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); buf->len is a small wire-derived value while the iov_lens are at page scale, so the per-section loops legitimately consume far more bytes than buf->len records. The wrapped buf->len then propagates as the authoritative stream bound into every downstream XDR decoder. Fix by clamping the decrement so buf->len bottoms out at zero: buf->len -= min_t(unsigned int, buf->len, len - trim); On the normal path where the iov_lens sum to buf->len, (len - trim) is always <= buf->len and the result is identical to before. No callers change behavior outside the underflow case.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 19:23 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a3d77bcd974b8625d…
https://git.kernel.org/stable/c/fa16bbe987b47e771…
https://git.kernel.org/stable/c/a924ac4c78afab71b…
https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfb…
https://git.kernel.org/stable/c/e6267cccd7b05cc51…
https://git.kernel.org/stable/c/ad0cce80d4af2f746…
https://git.kernel.org/stable/c/85e9602650e9df071…
https://git.kernel.org/stable/c/3f491306dcb673ff5…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < a3d77bcd974b8625d16bddf448cb3a1b5e37049c (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < fa16bbe987b47e771e52eeb1b4540f18d92496ac (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < a924ac4c78afab71bf82641afa3b62e0c4a8b55e (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < e6267cccd7b05cc514e57f2160aa8db85f5c2701 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < ad0cce80d4af2f74674e8b635d97aa3880e83da8 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 85e9602650e9df07190abe817cee3b4d9bc3df17 (git) Affected: 4c190e2f913f038c9c91ee63b59cd037260ba353 , < 3f491306dcb673ff5e78e1044ba450c58978774e (git)	guessed
Linux	Linux	Affected: 3.9 Unaffected: 0 , < 3.9 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:23:51.789342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:43.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3d77bcd974b8625d16bddf448cb3a1b5e37049c",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "fa16bbe987b47e771e52eeb1b4540f18d92496ac",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "a924ac4c78afab71bf82641afa3b62e0c4a8b55e",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            },
            {
              "lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
              "status": "affected",
              "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n    fix_len:\n            buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before.  No\ncallers change behavior outside the underflow case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - xdr_buf_trim() is reached from nfsd RPCSEC_GSS privacy unwrap on TCP/2049 (svcauth_gss_unwrap_priv \u2192 gss_unwrap \u2192 gss_krb5_unwrap_v2) and from the NFS client\u0027s gss_unwrap_resp_priv() on every krb5p reply, so a remote NFS peer delivers the wrap token over the network.\nAC:L - A peer holding the GSS session keys can encrypt a RFC 4121 wrap token so that after decrypt, buf-\u003elen is a small wire-derived value while iov_lens remain page-scale; xdr_buf_trim() then subtracts more than buf-\u003elen and wraps, with no race or layout outside attacker control.\nPR:N - A malicious or compromised NFS server that already shares a krb5p GSS context needs no account or capability on the victim client; ordinary krb5p replies and NFSv4.0 GSS callbacks are processed without local privileges on that host.\nUI:N - Once a krb5p NFS mount exists, the client unwraps every privacy-protected reply and NFSv4.0 GSS callback with no further mount, click, or open; idle revalidations and server-driven callbacks are sufficient.\nS:U - The wrapped buf-\u003elen and subsequent XDR decode run in the host kernel that processed the RPC and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed buf-\u003elen (~UINT_MAX) becomes the authoritative stream bound, and on nfsd xdr-\u003enwords also underflows via saved_len - buf-\u003elen, so later xdr_read_pages/xdr_shrink_bufhead and NFS XDR decoders read far past the receive buffer into adjacent kernel memory.\nI:H - xdr_shrink_bufhead() calls xdr_buf_head_shift_right() with a near-UINT_MAX length derived from the wrapped buf-\u003elen, and garbage xdr_stream_pos values can index the svc pages[] array out of bounds, an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Those unbounded XDR copies and the inconsistent xdr_buf (wrapped length versus iov_lens) oops or panic nfsd or the NFS client, and the peer can repeat the request at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:48:44.059Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
        },
        {
          "url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
        }
      ],
      "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89551",
    "datePublished": "2026-09-11T19:44:25.327Z",
    "dateReserved": "2026-09-11T19:38:34.723Z",
    "dateUpdated": "2026-10-19T08:48:44.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89551",
      "date": "2026-11-09",
      "epss": "0.00514",
      "percentile": "0.44097"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T02:15:17.000Z",
      "cve": "CVE-2026-89551",
      "id": "msrc_CVE-2026-89551",
      "initial_release_date": "2026-09-13T01:13:20.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89551.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xdr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a3d77bcd974b8625d16bddf448cb3a1b5e37049c",
                    "status": "affected",
                    "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fa16bbe987b47e771e52eeb1b4540f18d92496ac",
                    "status": "affected",
                    "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a924ac4c78afab71bf82641afa3b62e0c4a8b55e",
                    "status": "affected",
                    "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4",
                    "status": "affected",
                    "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
                    "status": "affected",
                    "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
                    "status": "affected",
                    "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
                    "status": "affected",
                    "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
                    "status": "affected",
                    "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/xdr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.9"
                  },
                  {
                    "lessThan": "3.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n    fix_len:\n            buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before.  No\ncallers change behavior outside the underflow case."
          }
        ],
        "id": "CVE-2026-89551",
        "lastModified": "2026-10-19T09:17:50.393",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-89551",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:23:51.789342Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-11T20:19:38.640",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-06T01:17:49+00:00",
      "cve": "CVE-2026-89551",
      "id": "CVE-2026-89551",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "203",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89551.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-89551",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T19:23:51.789342Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T19:23:52.353Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/sunrpc/xdr.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "a3d77bcd974b8625d16bddf448cb3a1b5e37049c",
                  "status": "affected",
                  "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                  "versionType": "git"
                },
                {
                  "lessThan": "fa16bbe987b47e771e52eeb1b4540f18d92496ac",
                  "status": "affected",
                  "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                  "versionType": "git"
                },
                {
                  "lessThan": "a924ac4c78afab71bf82641afa3b62e0c4a8b55e",
                  "status": "affected",
                  "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                  "versionType": "git"
                },
                {
                  "lessThan": "4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4",
                  "status": "affected",
                  "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                  "versionType": "git"
                },
                {
                  "lessThan": "e6267cccd7b05cc514e57f2160aa8db85f5c2701",
                  "status": "affected",
                  "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                  "versionType": "git"
                },
                {
                  "lessThan": "ad0cce80d4af2f74674e8b635d97aa3880e83da8",
                  "status": "affected",
                  "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                  "versionType": "git"
                },
                {
                  "lessThan": "85e9602650e9df07190abe817cee3b4d9bc3df17",
                  "status": "affected",
                  "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                  "versionType": "git"
                },
                {
                  "lessThan": "3f491306dcb673ff5e78e1044ba450c58978774e",
                  "status": "affected",
                  "version": "4c190e2f913f038c9c91ee63b59cd037260ba353",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/sunrpc/xdr.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "3.9"
                },
                {
                  "lessThan": "3.9",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.270",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.221",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.188",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.157",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.109",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.50",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.2.*",
                  "status": "unaffected",
                  "version": "7.2.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "7.3",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.270",
                      "versionStartIncluding": "3.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.221",
                      "versionStartIncluding": "3.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.188",
                      "versionStartIncluding": "3.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.157",
                      "versionStartIncluding": "3.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.109",
                      "versionStartIncluding": "3.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.50",
                      "versionStartIncluding": "3.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.2.4",
                      "versionStartIncluding": "3.9",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.3",
                      "versionStartIncluding": "3.9",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n    fix_len:\n            buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before.  No\ncallers change behavior outside the underflow case."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - xdr_buf_trim() is reached from nfsd RPCSEC_GSS privacy unwrap on TCP/2049 (svcauth_gss_unwrap_priv \u2192 gss_unwrap \u2192 gss_krb5_unwrap_v2) and from the NFS client\u0027s gss_unwrap_resp_priv() on every krb5p reply, so a remote NFS peer delivers the wrap token over the network.\nAC:L - A peer holding the GSS session keys can encrypt a RFC 4121 wrap token so that after decrypt, buf-\u003elen is a small wire-derived value while iov_lens remain page-scale; xdr_buf_trim() then subtracts more than buf-\u003elen and wraps, with no race or layout outside attacker control.\nPR:N - A malicious or compromised NFS server that already shares a krb5p GSS context needs no account or capability on the victim client; ordinary krb5p replies and NFSv4.0 GSS callbacks are processed without local privileges on that host.\nUI:N - Once a krb5p NFS mount exists, the client unwraps every privacy-protected reply and NFSv4.0 GSS callback with no further mount, click, or open; idle revalidations and server-driven callbacks are sufficient.\nS:U - The wrapped buf-\u003elen and subsequent XDR decode run in the host kernel that processed the RPC and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed buf-\u003elen (~UINT_MAX) becomes the authoritative stream bound, and on nfsd xdr-\u003enwords also underflows via saved_len - buf-\u003elen, so later xdr_read_pages/xdr_shrink_bufhead and NFS XDR decoders read far past the receive buffer into adjacent kernel memory.\nI:H - xdr_shrink_bufhead() calls xdr_buf_head_shift_right() with a near-UINT_MAX length derived from the wrapped buf-\u003elen, and garbage xdr_stream_pos values can index the svc pages[] array out of bounds, an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Those unbounded XDR copies and the inconsistent xdr_buf (wrapped length versus iov_lens) oops or panic nfsd or the NFS client, and the peer can repeat the request at will."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-19T08:48:44.059Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c"
            },
            {
              "url": "https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac"
            },
            {
              "url": "https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e"
            },
            {
              "url": "https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4"
            },
            {
              "url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
            },
            {
              "url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
            },
            {
              "url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
            },
            {
              "url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
            }
          ],
          "title": "SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-89551",
        "datePublished": "2026-09-11T19:44:25.327Z",
        "dateReserved": "2026-09-11T19:38:34.723Z",
        "dateUpdated": "2026-10-19T08:48:44.059Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-7GQJ-379Q-CVHQ

Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-14 15:32

Details

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

xdr_buf_trim() trims len bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp:

fix_len:
        buf->len -= (len - trim);

When the caller has set buf->len to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf->len and the unsigned subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches xdr_buf_trim() in exactly that state:

buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);

buf->len is a small wire-derived value while the iov_lens are at page scale, so the per-section loops legitimately consume far more bytes than buf->len records. The wrapped buf->len then propagates as the authoritative stream bound into every downstream XDR decoder.

Fix by clamping the decrement so buf->len bottoms out at zero:

buf->len -= min_t(unsigned int, buf->len, len - trim);

On the normal path where the iov_lens sum to buf->len, (len - trim) is always <= buf->len and the result is identical to before. No callers change behavior outside the underflow case.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89551"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T20:19:38Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf-\u003elen without any clamp:\n\n    fix_len:\n            buf-\u003elen -= (len - trim);\n\nWhen the caller has set buf-\u003elen to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf-\u003elen is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf-\u003elen bottoms out at zero:\n\n    buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);\n\nOn the normal path where the iov_lens sum to buf-\u003elen, (len - trim)\nis always \u003c= buf-\u003elen and the result is identical to before.  No\ncallers change behavior outside the underflow case.",
  "id": "GHSA-7gqj-379q-cvhq",
  "modified": "2026-09-14T15:32:28Z",
  "published": "2026-09-11T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89551"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-89551

Vulnerability from csaf_microsoft - Published: 2026-09-13 01:13 - Updated: 2026-10-02 02:44

Summary

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Scope

1 vulnerability in this advisory, including CVE-2026-89551.

CVE-2026-89551

Fixed: 1 product Known affected: 2 products

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OPENSUSE-SU-2026:11880-1

Vulnerability from csaf_opensuse - Published: 2026-09-24 00:00 - Updated: 2026-11-04 21:56

Summary

kernel-devel-7.2.7-1.1 on GA media

Severity

Moderate

Scope

904 vulnerabilities in this advisory, including CVE-2026-89551.

CVE-2026-89551

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 16 products

Open the full advisory

OPENSUSE-SU-2026:22091-1

Vulnerability from csaf_opensuse - Published: 2026-10-12 15:44 - Updated: 2026-10-19 17:25

Summary

Security update for the Linux Kernel

Severity

Important

Scope

401 vulnerabilities in this advisory, including CVE-2026-89551.

CVE-2026-89551

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 136 products

Open the full advisory

SUSE-SU-2026:24179-1

Vulnerability from csaf_suse - Published: 2026-10-12 13:24 - Updated: 2026-10-20 09:49

Summary

Security update for the Linux Kernel

Severity

Important

Scope

401 vulnerabilities in this advisory, including CVE-2026-89551.

CVE-2026-89551

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 8 products

Open the full advisory

SUSE-SU-2026:24181-1

Vulnerability from csaf_suse - Published: 2026-10-12 15:51 - Updated: 2026-10-20 09:49

Summary

Security update for the Linux Kernel

Severity

Important

Scope

473 vulnerabilities in this advisory, including CVE-2026-89551.

CVE-2026-89551

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 17 products

Open the full advisory

SUSE-SU-2026:24182-1

Vulnerability from csaf_suse - Published: 2026-10-12 14:42 - Updated: 2026-10-20 09:49

Summary

Security update for the Linux Kernel

Severity

Important

Scope

479 vulnerabilities in this advisory, including CVE-2026-89551.

CVE-2026-89551

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 20 products

Open the full advisory

SUSE-SU-2026:24184-1

Vulnerability from csaf_suse - Published: 2026-10-12 13:51 - Updated: 2026-10-20 09:49

Summary

Security update for the Linux Kernel

Severity

Important

Scope

401 vulnerabilities in this advisory, including CVE-2026-89551.

CVE-2026-89551

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 28 products

Open the full advisory

SUSE-SU-2026:24197-1

Vulnerability from csaf_suse - Published: 2026-10-12 14:15 - Updated: 2026-10-21 11:49

Summary

Security update for the Linux Kernel

Severity

Important

Scope

401 vulnerabilities in this advisory, including CVE-2026-89551.

CVE-2026-89551

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 9 products

Open the full advisory

SUSE-SU-2026:24235-1

Vulnerability from csaf_suse - Published: 2026-10-12 13:51 - Updated: 2026-10-21 11:50

Summary

Security update for the Linux Kernel

Severity

Important

Scope

401 vulnerabilities in this advisory, including CVE-2026-89551.

CVE-2026-89551

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Recommended: 114 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-89551 (GCVE-0-2026-89551)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour