{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "b0bc53470d1af01f62a0fe2d405cf56477804863"
            },
            {
              "fixed": "56b29d62017c7dd1718d060dd5b3a2ce61095d0c"
            },
            {
              "fixed": "0e18641708eaa8bc3c1ff338cd844aeadbd52bac"
            },
            {
              "fixed": "e0778464049b0238f2915a40007a4154f86cf351"
            },
            {
              "fixed": "0fa8a8acae57e6373962741d5b06d13f44aba6a9"
            },
            {
              "fixed": "11539e8fcce0b0af062ae5fecf7b3676c2f7aeed"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.6.157"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.109"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.50"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93207.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail.  The caller storage is svcdata-\u003eclcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests.  Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value.  Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer.",
  "id": "CVE-2026-93207",
  "modified": "2026-09-26T03:30:34.176022701Z",
  "published": "2026-09-24T15:10:30.942Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93207.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93207"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry"
}