CVE-2026-89541 Linux CVE debrief

Who should care

Linux kernel maintainers, system administrators, and security teams responsible for Linux-based systems, especially those using krb5p NFS servers, should verify and apply patches, and monitor system logs. These individuals should review the system's Linux kernel version and update if necessary to prevent potential out-of-bounds reads. They should also implement compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

A vulnerability in the Linux kernel's SUNRPC can cause out-of-bounds reads. Linux kernel maintainers, system administrators, and security teams should verify and apply patches, and monitor system logs.

• Potential out-of-bounds reads in gss_krb5_unwrap_v2()
• Verification of kernel version and patch application required
• Monitoring system logs for exploitation attempts recommended

Technical summary

The gss_unwrap_resp_priv function in the Linux kernel's SUNRPC did not properly validate the RPCSEC_GSS opaque length. A crafted reply from a krb5p NFS server can cause out-of-bounds reads in gss_krb5_unwrap_v2(). The fix involves replacing a single combined check with three guards to ensure safe u32 arithmetic and enforce the RFC 4121 minimum outer token length. This fix prevents potential out-of-bounds reads and ensures the integrity of the Linux kernel's SUNRPC functionality. Linux kernel maintainers, system administrators, and security teams should verify and apply patches, and monitor system logs.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to ensure the SUNRPC vulnerability is addressed.
• Verify the system's Linux kernel version and update if necessary.
• Monitor system logs for potential exploitation attempts.
• Perform a thorough review of the system's exposure to the vulnerability.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and versions is not explicitly stated. The fix involves replacing a single combined check with three guards to ensure safe u32 arithmetic and enforce the RFC 4121 minimum outer token length.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.