{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89541 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89541 is a critical vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89541 and fix it if it is affected.\n\nWhat it is: CVE-2026-89541 is a critical vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89541 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89541/ (Markdown: https://insights.sbomify.com/CVE-2026-89541/index.md)","id":"CVE-2026-89541","markdown":"https://insights.sbomify.com/CVE-2026-89541/index.md","name":"CVE-2026-89541","record":{"aliases":["AZL-100877","BELL-CVE-2026-89541","DEBIAN-CVE-2026-89541","GHSA-8h82-j8r3-jr82","UBUNTU-CVE-2026-89541"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel SUNRPC","requires_auth":"none","summary":"A crafted RPCSEC_GSS reply from a malicious NFS server can cause integer overflow leading to out-of-bounds reads and potential crashes in the Linux kernel.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_unwrap_resp_priv length checks\n\ngss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with\n\n    offset = (u8 *)(p) - (u8 *)head-\u003eiov_base;\n    if (offset + opaque_len \u003e rcv_buf-\u003elen)\n            goto unwrap_failed;\n    maj_stat = gss_unwrap(ctx-\u003egc_gss_ctx, offset,\n                          offset + opaque_len, rcv_buf);\n\nBoth operands are u32 and the sum is computed in u32. A reply with\nopaque_len near 0xffffffff makes offset + opaque_len wrap to a small\nvalue that is below rcv_buf-\u003elen, so the bound check passes and\ngss_unwrap() is called with end \u003c begin. The check also lacks a\nlower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is\naccepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt\nheader reads at ptr+4 and ptr+6 then run past the token.\n\nA krb5p NFS server returning a crafted RPCSEC_GSS reply can drive\nthe client into out-of-bounds reads in gss_krb5_unwrap_v2() and the\nrotate_left() loop that follows.\n\nFix by replacing the single combined check with three guards that\nare safe in u32 arithmetic and that enforce the RFC 4121 minimum\nouter token length:\n\n    if (offset \u003e rcv_buf-\u003elen)\n            goto unwrap_failed;\n    if (opaque_len \u003e rcv_buf-\u003elen - offset)\n            goto unwrap_failed;\n    if (opaque_len \u003c GSS_KRB5_TOK_HDR_LEN)\n            goto unwrap_failed;\n\nThe first guard makes the subtraction in the second guard\nunconditionally safe; offset is derived from a successful\nxdr_inline_decode() in the head kvec, so in practice it already\nsatisfies the bound. The floor mirrors the server-side check added\nin commit 5b757c2e57a5 (\"SUNRPC: svcauth_gss: enforce krb5 token\nminimum length\").","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"SUNRPC: harden gss_unwrap_resp_priv length checks","id":"CVE-2026-89541","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"SUNRPC: harden gss_krb5_unwrap_v2 against short tokens","id":"CVE-2026-89542"},"packages":[],"prev":{"headline":"sunrpc: init gssp_lock before publishing proc entry","id":"CVE-2026-89540"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A crafted RPCSEC_GSS reply from a malicious NFS server can cause integer overflow leading to out-of-bounds reads and potential crashes in the Linux kernel.","url":"https://insights.sbomify.com/CVE-2026-89541/"}