{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c"
            },
            {
              "fixed": "0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd"
            },
            {
              "fixed": "dd6afc6cab8c5d387d1ed2f069562ef7bdadd651"
            },
            {
              "fixed": "de942dd8c2c8358bcad04ce44271954c48924423"
            },
            {
              "fixed": "2eed1e6a976a44015c3ee78841fe336796e2b21c"
            },
            {
              "fixed": "a919c5c88769cf8fb3ec071e6078d830bf512489"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.18"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89550.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: svcauth_gss: enforce krb5 token minimum length\n\nsvcauth_gss_unwrap_priv() validates only an upper bound on the\nwire-supplied opaque length before handing the buffer to\ngss_unwrap():\n\n    if (len \u003e xdr_stream_remaining(xdr))\n            goto unwrap_failed;\n    offset = xdr_stream_pos(xdr);\n    ...\n    maj_stat = gss_unwrap(ctx, offset, offset + len, buf);\n\nThe wire value `len` flows unchanged as the upper bound into the\nkrb5 unwrap path, so a len in [0, 16] passes this check and is\nhanded to gss_unwrap(). For a krb5 v2 context that lands in\ngss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token\nheader fields at ptr+4 and ptr+6 and then calls rotate_left()\nbefore any integrity check. With a sub-header length the header\nreads run past the token, and _rotate_left()'s `shift %= buf-\u003elen`\npath can divide by zero when buf-\u003elen has been driven to zero by\nthe truncated token. A header-only token (len == 16) is equally\ninvalid: with a non-zero RRC field and the opaque blob ending at\nthe XDR buffer boundary, rotate_left() builds a zero-length\nsubbuffer, reaching the same division.\n\nReject the token at the server entry point before it reaches the\nkrb5 unwrap core. A valid sealed RFC 4121 token must contain\nthe 16-byte header plus at least some encrypted payload.\n\nFix by adding a minimum-length check immediately after the\nexisting upper-bound check:\n\n    if (len \u003c= GSS_KRB5_TOK_HDR_LEN)\n            goto unwrap_failed;",
  "id": "CVE-2026-89550",
  "modified": "2026-09-16T03:30:17.874713879Z",
  "published": "2026-09-11T19:44:24.572Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2eed1e6a976a44015c3ee78841fe336796e2b21c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a919c5c88769cf8fb3ec071e6078d830bf512489"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dd6afc6cab8c5d387d1ed2f069562ef7bdadd651"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/de942dd8c2c8358bcad04ce44271954c48924423"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89550.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89550"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SUNRPC: svcauth_gss: enforce krb5 token minimum length"
}