CVE-2026-89544 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and verify patched versions. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

A vulnerability in the Linux kernel's SUNRPC gssx XDR option-array decoder has been resolved. Defenders should assess exposure, verify patched versions, and monitor for potential use-after-free and NULL dereference attempts.

• Verify patched Linux kernel versions to prevent potential use-after-free attempts
• Assess exposure by checking kernel configurations and versions
• Monitor for potential NULL dereference attempts

Technical summary

The gssx_dec_option_array function had four coupled defects: a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free. Fixes include adjusting oa->count and data allocation, freeing logic, and group_info reference counting. The fixes ensure that the option array count and data allocation are properly synchronized, and that the group_info reference counting is correctly managed to prevent use-after-free and NULL dereference attempts. The vulnerability was resolved by applying these fixes to the Linux kernel.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patched versions.

Recommended defensive actions

• Assess exposure by checking Linux kernel versions and configurations
• Verify patched versions are deployed
• Monitor for potential use-after-free and NULL dereference attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Three source references from the Linux kernel Git repository are provided. The vulnerability was resolved by fixing four coupled defects in the gssx XDR option-array decoder, including a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose. Linux kernel maintainers, users, and administrators should verify patched versions and assess exposure. The fixes adjust the option array and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.