{"id":"CVE-2026-89551","revision":"49cc452a11ae4182a45f59170e95b626","records":[{"revision":"49cc452a11ae4182a45f59170e95b626","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89551","aliases":[],"title":"SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow\n\nxdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by\nwalking the tail, pages, and head iovecs.  Each per-section step\nuses min_t() so it never removes more bytes than that section\nholds, but the final accounting at the fix_len label subtracts the\ntotal bytes actually consumed from buf->len without any clamp:\n\n    fix_len:\n            buf->len -= (len - trim);\n\nWhen the caller has set buf->len to a value smaller than the sum\nof the iov_lens, (len - trim) can exceed buf->len and the unsigned\nsubtraction wraps to near UINT_MAX.  gss_krb5_unwrap_v2() reaches\nxdr_buf_trim() in exactly that state:\n\n    buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;\n    buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);\n    xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);\n\nbuf->len is a small wire-derived value while the iov_lens are at\npage scale, so the per-section loops legitimately consume far more\nbytes than buf->len records.  The wrapped buf->len then propagates\nas the authoritative stream bound into every downstream XDR\ndecoder.\n\nFix by clamping the decrement so buf->len bottoms out at zero:\n\n    buf->len -= min_t(unsigned int, buf->len, len - trim);\n\nOn the normal path where the iov_lens sum to buf->len, (len - trim)\nis always <= buf->len and the result is identical to before.  No\ncallers change behavior outside the underflow case.","state":0,"publishedAt":"2026-09-11T19:44:25.327+00:00","modifiedAt":"2026-10-19T08:48:44.059+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sunrpc/xdr.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4c190e2f913f038c9c91ee63b59cd037260ba353\",\n                            \"lessThan\": \"a3d77bcd974b8625d16bddf448cb3a1b5e37049c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c190e2f913f038c9c91ee63b59cd037260ba353\",\n                            \"lessThan\": \"fa16bbe987b47e771e52eeb1b4540f18d92496ac\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c190e2f913f038c9c91ee63b59cd037260ba353\",\n                            \"lessThan\": \"a924ac4c78afab71bf82641afa3b62e0c4a8b55e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c190e2f913f038c9c91ee63b59cd037260ba353\",\n                            \"lessThan\": \"4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c190e2f913f038c9c91ee63b59cd037260ba353\",\n                            \"lessThan\": \"e6267cccd7b05cc514e57f2160aa8db85f5c2701\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c190e2f913f038c9c91ee63b59cd037260ba353\",\n                            \"lessThan\": \"ad0cce80d4af2f74674e8b635d97aa3880e83da8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c190e2f913f038c9c91ee63b59cd037260ba353\",\n                            \"lessThan\": \"85e9602650e9df07190abe817cee3b4d9bc3df17\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4c190e2f913f038c9c91ee63b59cd037260ba353\",\n                            \"lessThan\": \"3f491306dcb673ff5e78e1044ba450c58978774e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sunrpc/xdr.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/a3d77bcd974b8625d16bddf448cb3a1b5e37049c","https://git.kernel.org/stable/c/fa16bbe987b47e771e52eeb1b4540f18d92496ac","https://git.kernel.org/stable/c/a924ac4c78afab71bf82641afa3b62e0c4a8b55e","https://git.kernel.org/stable/c/4bf59cb0ea5b0ddfbc46a1dc2fa78fc8b9986ce4","https://git.kernel.org/stable/c/e6267cccd7b05cc514e57f2160aa8db85f5c2701","https://git.kernel.org/stable/c/ad0cce80d4af2f74674e8b635d97aa3880e83da8","https://git.kernel.org/stable/c/85e9602650e9df07190abe817cee3b4d9bc3df17","https://git.kernel.org/stable/c/3f491306dcb673ff5e78e1044ba450c58978774e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89551","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89551","identifiers":["CVE-2026-89551"]},"retained":false,"historicalAffected":[]}],"coverage":[]}