{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89538 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89538 is a critical denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89538 and fix it if it is affected.\n\nWhat it is: CVE-2026-89538 is a critical denial of service vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89538 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89538/ (Markdown: https://insights.sbomify.com/CVE-2026-89538/index.md)","id":"CVE-2026-89538","markdown":"https://insights.sbomify.com/CVE-2026-89538/index.md","name":"CVE-2026-89538","record":{"aliases":["AZL-100070","BELL-CVE-2026-89538","DEBIAN-CVE-2026-89538","GHSA-3r47-q2hr-fjxp","UBUNTU-CVE-2026-89538"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel SUNRPC","requires_auth":"none","summary":"An attacker with a valid GSS context can cause a denial of service by sending malformed Kerberos v2 tokens that leave the XDR buffer in an inconsistent state.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject krb5 v2 wrap tokens with oversized ec field\n\ngss_krb5_unwrap_v2() sets buf-\u003elen to a logical\nlength, which can be much smaller than head[0].iov_len\n(the allocated receive-page capacity).  It then calls\nxdr_buf_trim() with a trim length derived from the 16-bit\n\"extra count\" (ec) field in the Kerberos v2 token header.\n\nThe ec field is authenticated by the post-decrypt memcmp()\nagainst the encrypted header copy, so a randomly-mutated\nvalue is rejected.  However, any peer holding a valid GSS\ncontext can legitimately encrypt a token whose ec exceeds\nthe plaintext length.  Per RFC 4121, such a token is\nstructurally malformed.\n\nAlthough xdr_buf_trim() now clamps the buf-\u003elen subtraction\nto avoid unsigned underflow, the buffer is still left in a\nsemantically invalid state (zero length, inconsistent iov\nlengths) when ec is oversized.\n\nReject these tokens before calling xdr_buf_trim(), giving\ncallers a well-defined GSS_S_DEFECTIVE_TOKEN error and\nkeeping the xdr_buf internally consistent.  The wrapped blob\nbegins at a nonzero offset -- both callers pass len as\noffset + opaque_len -- so buf-\u003elen still counts the offset\nbytes that precede the blob.  Compare the trim length\nagainst the remaining wrapped segment, buf-\u003elen - offset,\nrather than the whole buffer; comparing against buf-\u003elen\nalone leaves an offset-wide window in which an oversized ec\npasses the test and xdr_buf_trim() cuts into the bytes ahead\nof the blob.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field","id":"CVE-2026-89538","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"SUNRPC: reject duplicate CREDS_VALUE options","id":"CVE-2026-89539"},"packages":[],"prev":{"headline":"SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2","id":"CVE-2026-89537"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"An attacker with a valid GSS context can cause a denial of service by sending malformed Kerberos v2 tokens that leave the XDR buffer in an inconsistent state.","url":"https://insights.sbomify.com/CVE-2026-89538/"}