{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "de9c17eb4a912c9028f7b470eb80815144883b26"
            },
            {
              "fixed": "7a946b2e7207f968902f2147ab9b30726f82f7ab"
            },
            {
              "fixed": "b94f6719dcd9f7a609bc5f459f85795900e77d25"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.35"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89537.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2\n\ngss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags\nbyte at ptr[2], and padding at ptr[3..7], then passes\nptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg().\nNone of these accesses check read_token-\u003elen first.\n\nThe minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus\nctx-\u003ekrb5e-\u003ecksum_len (12-24, depending on the enctype).  All callers\naccept shorter tokens from the wire:\n\n - gss_unwrap_resp_integ() enforces only an upper bound\n   (offset + len \u003c= rcv_buf-\u003elen) before allocating\n   mic.data = kmalloc(len) and passing it to gss_verify_mic().\n   A malicious NFS server can therefore supply a short checksum\n   opaque, producing a small slab allocation that the Kerberos MIC\n   verifier reads past.\n\n - gss_validate() enforces only len \u003c= RPC_MAX_AUTH_SIZE (400)\n   before passing the wire-supplied length to\n   gss_validate_seqno_mic(), which constructs a mic xdr_netobj\n   and calls gss_verify_mic().\n\n - svcauth_gss_verify_header() enforces only\n   checksum.len \u003e= XDR_UNIT (4 bytes) before dispatching to\n   gss_verify_mic().\n\n - svcauth_gss_unwrap_integ() checks only that the checksum fits\n   in gsd-\u003egsd_scratch.\n\nAdd a length guard at the top of gss_krb5_verify_mic_v2(), before any\nptr[] access or scatterlist construction.  Well-formed MIC tokens from\ngss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN +\ncksum_len bytes, so valid traffic is unaffected.",
  "id": "CVE-2026-89537",
  "modified": "2026-09-13T03:30:43.034759651Z",
  "published": "2026-09-11T19:44:15.216Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89537.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89537"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2"
}