CVE-2026-89538
In the Linux kernel's SUNRPC implementation, the gss_krb5_unwrap_v2 function incorrectly handles Kerberos v2 wrap tokens that have an oversized 'extra count' (ec) field. Although the field is authenticated, a peer with a valid GSS context can encrypt a token where ec exceeds the plaintext length, leaving the internal buffer in an inconsistent state after processing. This flaw can be exploited to cause a denial‑of‑service or other impacts and is rated critical with a CVSS base score of 9.8.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (specific versions not listed in the provided data).
Real-world impact
An attacker with a valid GSS context could send a malformed Kerberos v2 token that triggers inconsistent buffer state, potentially leading to service disruption or other adverse effects.
Why this severity
CVSS 3.1 score: 9.8 (Critical) – Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality: High, Integrity: High, Availability: High.
What to do about it
- 01Update the Linux kernel to a version that includes the patch for CVE-2026-89538 (the vulnerability has been marked as resolved in the kernel).
- 02Reboot the system or restart affected services after applying the kernel update.
NVD description states the vulnerability has been resolved in the Linux kernel.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 5h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.