{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2  gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token-\u003elen first.  The minimum safe token size is GSS_KRB5_TOK_HDR_LEN (16) plus ctx-\u003ekrb5e-\u003ecksum_len (12-24, depending on the enctype).  All callers accept shorter tokens from the wire:   - gss_unwrap_resp_integ() enforces only an upper bound    (offset + len \u003c= rcv_buf-\u003elen) before allocating    mic.data = kmalloc(len) and passing it to gss_verify_mic().    A malicious NFS server can therefore supply a short checksum    opaque, producing a small slab allocation that the Kerberos MIC    verifier reads past.   - gss_validate() enforces only len \u003c= RPC_MAX_AUTH_SIZE (400)    before passing the wire-supplied length to    gss_validate_seqno_mic(), which constructs a mic xdr_netobj    and calls gss_verify_mic().   - svcauth_gss_verify_header() enforces only    checksum.len \u003e= XDR_UNIT (4 bytes) before dispatching to    gss_verify_mic().   - svcauth_gss_unwrap_integ() checks only that the checksum fits    in gsd-\u003egsd_scratch.  Add a length guard at the top of gss_krb5_verify_mic_v2(), before any ptr[] access or scatterlist construction.  Well-formed MIC tokens from gss_krb5_get_mic_v2() already have exactly GSS_KRB5_TOK_HDR_LEN + cksum_len bytes, so valid traffic is unaffected.",
  "id": "DEBIAN-CVE-2026-89537",
  "modified": "2026-09-14T08:47:36.878333833Z",
  "published": "2026-09-11T20:19:36.733Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89537"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-89537"
  ]
}