GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89541 (GCVE-0-2026-89541)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-14 12:00
VLAI
Title
SUNRPC: harden gss_unwrap_resp_priv length checks
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length checks gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with offset = (u8 *)(p) - (u8 *)head->iov_base; if (offset + opaque_len > rcv_buf->len) goto unwrap_failed; maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset, offset + opaque_len, rcv_buf); Both operands are u32 and the sum is computed in u32. A reply with opaque_len near 0xffffffff makes offset + opaque_len wrap to a small value that is below rcv_buf->len, so the bound check passes and gss_unwrap() is called with end < begin. The check also lacks a lower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is accepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt header reads at ptr+4 and ptr+6 then run past the token. A krb5p NFS server returning a crafted RPCSEC_GSS reply can drive the client into out-of-bounds reads in gss_krb5_unwrap_v2() and the rotate_left() loop that follows. Fix by replacing the single combined check with three guards that are safe in u32 arithmetic and that enforce the RFC 4121 minimum outer token length: if (offset > rcv_buf->len) goto unwrap_failed; if (opaque_len > rcv_buf->len - offset) goto unwrap_failed; if (opaque_len < GSS_KRB5_TOK_HDR_LEN) goto unwrap_failed; The first guard makes the subtraction in the second guard unconditionally safe; offset is derived from a successful xdr_inline_decode() in the head kvec, so in practice it already satisfies the bound. The floor mirrors the server-side check added in commit 5b757c2e57a5 ("SUNRPC: svcauth_gss: enforce krb5 token minimum length").
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf , < 3691c4b3488d8ca046b9941e5be30c626dbbbb50 (git)
Affected: 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf , < 85fa6b12e8f439739ac36ef2aad925f37c8b976a (git)
Affected: 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf , < 401f6a5b338d05bb1069ad814d9f77e3c367854f (git)
Affected: 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf , < 81fd7654a8429718adfcb2a7e03496077f547ed0 (git)
Affected: 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf , < 89a15a50f84d32d4b99db86f957427fcbe20a99a (git)
Affected: 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf , < ebcbd2523a8524c3d24e111cdbed8e271d910269 (git)
Affected: 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf , < d395c30d570ca6168f0297b191709927d1258273 (git)
Affected: 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf , < 87831b92112c81db251d46756d65daa4f91af6a2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.15
Unaffected: 0 , < 2.6.15 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/auth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3691c4b3488d8ca046b9941e5be30c626dbbbb50",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "85fa6b12e8f439739ac36ef2aad925f37c8b976a",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "401f6a5b338d05bb1069ad814d9f77e3c367854f",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "81fd7654a8429718adfcb2a7e03496077f547ed0",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "89a15a50f84d32d4b99db86f957427fcbe20a99a",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "ebcbd2523a8524c3d24e111cdbed8e271d910269",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "d395c30d570ca6168f0297b191709927d1258273",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "87831b92112c81db251d46756d65daa4f91af6a2",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/auth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_unwrap_resp_priv length checks\n\ngss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with\n\n    offset = (u8 *)(p) - (u8 *)head-\u003eiov_base;\n    if (offset + opaque_len \u003e rcv_buf-\u003elen)\n            goto unwrap_failed;\n    maj_stat = gss_unwrap(ctx-\u003egc_gss_ctx, offset,\n                          offset + opaque_len, rcv_buf);\n\nBoth operands are u32 and the sum is computed in u32. A reply with\nopaque_len near 0xffffffff makes offset + opaque_len wrap to a small\nvalue that is below rcv_buf-\u003elen, so the bound check passes and\ngss_unwrap() is called with end \u003c begin. The check also lacks a\nlower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is\naccepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt\nheader reads at ptr+4 and ptr+6 then run past the token.\n\nA krb5p NFS server returning a crafted RPCSEC_GSS reply can drive\nthe client into out-of-bounds reads in gss_krb5_unwrap_v2() and the\nrotate_left() loop that follows.\n\nFix by replacing the single combined check with three guards that\nare safe in u32 arithmetic and that enforce the RFC 4121 minimum\nouter token length:\n\n    if (offset \u003e rcv_buf-\u003elen)\n            goto unwrap_failed;\n    if (opaque_len \u003e rcv_buf-\u003elen - offset)\n            goto unwrap_failed;\n    if (opaque_len \u003c GSS_KRB5_TOK_HDR_LEN)\n            goto unwrap_failed;\n\nThe first guard makes the subtraction in the second guard\nunconditionally safe; offset is derived from a successful\nxdr_inline_decode() in the head kvec, so in practice it already\nsatisfies the bound. The floor mirrors the server-side check added\nin commit 5b757c2e57a5 (\"SUNRPC: svcauth_gss: enforce krb5 token\nminimum length\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - gss_unwrap_resp_priv() runs in the Linux NFS/SUNRPC client while decoding RPCSEC_GSS privacy (krb5p) replies; a malicious or compromised NFS server supplies the crafted opaque_len and wrap token over the existing TCP/UDP/RDMA RPC connection.\nAC:L - The attacker fully controls the reply, including opaque_len and the cleartext RFC 4121 header, and a single response can make offset+opaque_len wrap in u32 or fall below GSS_KRB5_TOK_HDR_LEN; no race or layout beyond the attacker\u2019s control is required.\nPR:N - The attacker is the remote RPC/NFS peer that already holds the GSS session keys needed to pass gss_validate(); no local account, user namespace, or capability on the victim client is required.\nUI:N - Once a krb5p NFS mount or other SUNRPC GSS-privacy client is already in use, normal client RPCs elicit replies the attacker can craft; no extra victim action is needed at attack time.\nS:U - Out-of-bounds reads, rotate/decrypt memory corruption, and crashes stay inside the victim kernel\u2019s SUNRPC client and do not cross a VM, IOMMU, or other security-authority boundary.\nC:H - A short or wrapped opaque_len makes gss_krb5_unwrap_v2() read past the token at ptr+4/ptr+6 and feeds rotate_left()/decrypt with wrapped lengths, disclosing adjacent kernel memory; unwrap cleanup can also memmove nearly UINT_MAX bytes.\nI:H - The same wrapped lengths drive rotate_left() writes, CBC/AEAD decrypt over an unbounded xdr subsegment (xdr_buf_subsegment\u2019s error is ignored), and gss_krb5_unwrap_v2()\u2019s unsigned movelen underflow into a near-4GiB memmove, enabling kernel memory corruption.\nA:H - rotate_left() can divide-by-zero on a zero-length subbuffer, spin in a multi-gigabyte kernel loop on a wrapped subsegment, or oops/panic on the huge memmove or out-of-bounds header access."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:48.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3691c4b3488d8ca046b9941e5be30c626dbbbb50"
        },
        {
          "url": "https://git.kernel.org/stable/c/85fa6b12e8f439739ac36ef2aad925f37c8b976a"
        },
        {
          "url": "https://git.kernel.org/stable/c/401f6a5b338d05bb1069ad814d9f77e3c367854f"
        },
        {
          "url": "https://git.kernel.org/stable/c/81fd7654a8429718adfcb2a7e03496077f547ed0"
        },
        {
          "url": "https://git.kernel.org/stable/c/89a15a50f84d32d4b99db86f957427fcbe20a99a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebcbd2523a8524c3d24e111cdbed8e271d910269"
        },
        {
          "url": "https://git.kernel.org/stable/c/d395c30d570ca6168f0297b191709927d1258273"
        },
        {
          "url": "https://git.kernel.org/stable/c/87831b92112c81db251d46756d65daa4f91af6a2"
        }
      ],
      "title": "SUNRPC: harden gss_unwrap_resp_priv length checks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89541",
    "datePublished": "2026-09-11T19:44:18.188Z",
    "dateReserved": "2026-09-11T19:38:34.721Z",
    "dateUpdated": "2026-09-14T12:00:48.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89541",
      "date": "2026-09-19",
      "epss": "0.00521",
      "percentile": "0.43194"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/auth_gss/auth_gss.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3691c4b3488d8ca046b9941e5be30c626dbbbb50",
                    "status": "affected",
                    "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "85fa6b12e8f439739ac36ef2aad925f37c8b976a",
                    "status": "affected",
                    "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "401f6a5b338d05bb1069ad814d9f77e3c367854f",
                    "status": "affected",
                    "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "81fd7654a8429718adfcb2a7e03496077f547ed0",
                    "status": "affected",
                    "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "89a15a50f84d32d4b99db86f957427fcbe20a99a",
                    "status": "affected",
                    "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ebcbd2523a8524c3d24e111cdbed8e271d910269",
                    "status": "affected",
                    "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d395c30d570ca6168f0297b191709927d1258273",
                    "status": "affected",
                    "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "87831b92112c81db251d46756d65daa4f91af6a2",
                    "status": "affected",
                    "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sunrpc/auth_gss/auth_gss.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.15"
                  },
                  {
                    "lessThan": "2.6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_unwrap_resp_priv length checks\n\ngss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with\n\n    offset = (u8 *)(p) - (u8 *)head-\u003eiov_base;\n    if (offset + opaque_len \u003e rcv_buf-\u003elen)\n            goto unwrap_failed;\n    maj_stat = gss_unwrap(ctx-\u003egc_gss_ctx, offset,\n                          offset + opaque_len, rcv_buf);\n\nBoth operands are u32 and the sum is computed in u32. A reply with\nopaque_len near 0xffffffff makes offset + opaque_len wrap to a small\nvalue that is below rcv_buf-\u003elen, so the bound check passes and\ngss_unwrap() is called with end \u003c begin. The check also lacks a\nlower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is\naccepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt\nheader reads at ptr+4 and ptr+6 then run past the token.\n\nA krb5p NFS server returning a crafted RPCSEC_GSS reply can drive\nthe client into out-of-bounds reads in gss_krb5_unwrap_v2() and the\nrotate_left() loop that follows.\n\nFix by replacing the single combined check with three guards that\nare safe in u32 arithmetic and that enforce the RFC 4121 minimum\nouter token length:\n\n    if (offset \u003e rcv_buf-\u003elen)\n            goto unwrap_failed;\n    if (opaque_len \u003e rcv_buf-\u003elen - offset)\n            goto unwrap_failed;\n    if (opaque_len \u003c GSS_KRB5_TOK_HDR_LEN)\n            goto unwrap_failed;\n\nThe first guard makes the subtraction in the second guard\nunconditionally safe; offset is derived from a successful\nxdr_inline_decode() in the head kvec, so in practice it already\nsatisfies the bound. The floor mirrors the server-side check added\nin commit 5b757c2e57a5 (\"SUNRPC: svcauth_gss: enforce krb5 token\nminimum length\")."
          }
        ],
        "id": "CVE-2026-89541",
        "lastModified": "2026-09-14T13:19:09.203",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:37.247",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3691c4b3488d8ca046b9941e5be30c626dbbbb50"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/401f6a5b338d05bb1069ad814d9f77e3c367854f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/81fd7654a8429718adfcb2a7e03496077f547ed0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/85fa6b12e8f439739ac36ef2aad925f37c8b976a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/87831b92112c81db251d46756d65daa4f91af6a2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/89a15a50f84d32d4b99db86f957427fcbe20a99a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d395c30d570ca6168f0297b191709927d1258273"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ebcbd2523a8524c3d24e111cdbed8e271d910269"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-18T21:56:11+00:00",
      "cve": "CVE-2026-89541",
      "id": "CVE-2026-89541",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: SUNRPC: harden gss_unwrap_resp_priv length checks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89541.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:02:14Z",
      "cve": "CVE-2026-89541",
      "id": "CVE-2026-89541",
      "initial_release_date": "2026-09-16T00:02:14Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89541",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89541.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.