Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-89551

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by walking the tail, pages, and head iovecs. Each per-section step uses min_t() so it never removes more bytes than that section holds, but the final accounting at the fix_len label subtracts the total bytes actually consumed from buf->len without any clamp: fix_len: buf->len -= (len - trim); When the caller has set buf->len to a value smaller than the sum of the iov_lens, (len - trim) can exceed buf->len and the unsigned subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches xdr_buf_trim() in exactly that state: buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip); xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); buf->len is a small wire-derived value while the iov_lens are at page scale, so the per-section loops legitimately consume far more bytes than buf->len records. The wrapped buf->len then propagates as the authoritative stream bound into every downstream XDR decoder. Fix by clamping the decrement so buf->len bottoms out at zero: buf->len -= min_t(unsigned int, buf->len, len - trim); On the normal path where the iov_lens sum to buf->len, (len - trim) is always <= buf->len and the result is identical to before. No callers change behavior outside the underflow case.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 4c190e2f913f038c9c91ee63b59cd037260ba353 to < a3d77bcd974b8625d16bddf448cb3a1b5e37049caffected
  • 4c190e2f913f038c9c91ee63b59cd037260ba353 to < fa16bbe987b47e771e52eeb1b4540f18d92496acaffected
  • 4c190e2f913f038c9c91ee63b59cd037260ba353 to < a924ac4c78afab71bf82641afa3b62e0c4a8b55eaffected
  • 4c190e2f913f038c9c91ee63b59cd037260ba353 to < 4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4affected
  • 4c190e2f913f038c9c91ee63b59cd037260ba353 to < e6267cccd7b05cc514e57f2160aa8db85f5c2701affected
  • 4c190e2f913f038c9c91ee63b59cd037260ba353 to < ad0cce80d4af2f74674e8b635d97aa3880e83da8affected
  • 4c190e2f913f038c9c91ee63b59cd037260ba353 to < 85e9602650e9df07190abe817cee3b4d9bc3df17affected
  • 4c190e2f913f038c9c91ee63b59cd037260ba353 to < 3f491306dcb673ff5e78e1044ba450c58978774eaffected

Linux Linux

Default version status: affected

  • 3.9affected
  • 0 to < 3.9unaffected
  • 5.10.270 to ≤ 5.10.*unaffected
  • 5.15.221 to ≤ 5.15.*unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.109 to ≤ 6.12.*unaffected
  • 6.18.50 to ≤ 6.18.*unaffected
  • 7.2.4 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References