All vulnerabilities
CVE-2026-93207

Linux: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in56b29d62017c7dd1718d060dd5b3a2ce61095d0cAlso 0e18641708eaa8bc3c1ff338cd844aeadbd52bac, 0fa8a8acae57e6373962741d5b06d13f44aba6a9 and 1 moreCVE List
Published24 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 56b29d62017c7dd1718d060dd5b3a2ce61095d0cLinuxCVE List
  • 0e18641708eaa8bc3c1ff338cd844aeadbd52bacLinuxCVE List
  • 0fa8a8acae57e6373962741d5b06d13f44aba6a9LinuxCVE List
  • 11539e8fcce0b0af062ae5fecf7b3676c2f7aeedLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail. The caller storage is svcdata->clcred, which lives in the per-svc_rqst gss_svc_data and is reused across requests. Early decode failures leave partially decoded state mixed with residue from the prior request.

The trailing body_len tightness check is the sharpest case: xdr_stream_decode_opaque_inline() has already written gc_ctx.data with a borrowed inline pointer into the current request's XDR pages, but gc_ctx.len retains its prior value. Once the request pages are released the pooled clcred carries a dangling pointer paired with a stale length.

Zero the caller's rpc_gss_wire_cred at function entry so that every early-return path leaves a deterministic all-zero cred. On the trailing tightness-check path, gc_ctx.len is now zero instead of stale, which neuters length-driven consumers such as gss_svc_searchbyctx() that would otherwise walk the dangling data pointer.

Text from CVE List

Affected versions 12

  • Linuxaffected: b0bc53470d1af01f62a0fe2d405cf56477804863 before 56b29d62017c7dd1718d060dd5b3a2ce61095d0cCVE List
  • Linuxaffected: b0bc53470d1af01f62a0fe2d405cf56477804863 before 0e18641708eaa8bc3c1ff338cd844aeadbd52bacCVE List
  • Linuxaffected: b0bc53470d1af01f62a0fe2d405cf56477804863 before e0778464049b0238f2915a40007a4154f86cf351CVE List
  • Linuxaffected: b0bc53470d1af01f62a0fe2d405cf56477804863 before 0fa8a8acae57e6373962741d5b06d13f44aba6a9CVE List
  • Linuxaffected: b0bc53470d1af01f62a0fe2d405cf56477804863 before 11539e8fcce0b0af062ae5fecf7b3676c2f7aeedCVE List
  • Linuxaffected: 6.3CVE List
  • Linuxunaffected: all versions before 6.3CVE List
  • Linuxunaffected: 6.6.157 through 6.6.*CVE List
  • Linuxunaffected: 6.12.109 through 6.12.*CVE List
  • Linuxunaffected: 6.18.50 through 6.18.*CVE List
  • Linuxunaffected: 7.2.4 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5