{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  SUNRPC: xdr_buf_trim: clamp buf-\u003elen to avoid underflow  xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs.  Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf-\u003elen without any clamp:      fix_len:             buf-\u003elen -= (len - trim);  When the caller has set buf-\u003elen to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf-\u003elen and the unsigned subtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches xdr_buf_trim() in exactly that state:      buf-\u003ehead[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;     buf-\u003elen = len - (GSS_KRB5_TOK_HDR_LEN + headskip);     xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);  buf-\u003elen is a small wire-derived value while the iov_lens are at page scale, so the per-section loops legitimately consume far more bytes than buf-\u003elen records.  The wrapped buf-\u003elen then propagates as the authoritative stream bound into every downstream XDR decoder.  Fix by clamping the decrement so buf-\u003elen bottoms out at zero:      buf-\u003elen -= min_t(unsigned int, buf-\u003elen, len - trim);  On the normal path where the iov_lens sum to buf-\u003elen, (len - trim) is always \u003c= buf-\u003elen and the result is identical to before.  No callers change behavior outside the underflow case.",
  "id": "DEBIAN-CVE-2026-89551",
  "modified": "2026-09-15T08:47:26.727799461Z",
  "published": "2026-09-11T20:19:38.640Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-89551"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-89551"
  ]
}