CVE-2026-89541
A flaw in the Linux kernel’s RPCSEC_GSS handling allowed a crafted NFS server reply to bypass length checks and trigger out‑of‑bounds reads in the client. The patch adds proper bounds checks to prevent the overflow. The issue is now fixed in the kernel source.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel versions before the patch that implements the new bounds checks, affecting any system using RPCSEC_GSS for NFS.
Real-world impact
An attacker could send a specially crafted NFS reply to cause the client to read or corrupt memory, potentially leading to privilege escalation or denial of service.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited over the network with no user interaction, no privileges, and it compromises confidentiality, integrity, and availability.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the patch that adds the three bounds checks to gss_unwrap_resp_priv.
- 02Reboot the system to load the updated kernel.
NVD description
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.