CVE-2026-89544: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs
Summary
A Linux kernel vulnerability in SUNRPC (Sun Remote Procedure Call, a protocol for making function calls over networks) has four related bugs in the gssx_dec_option_array error handling code: it can set a counter before allocating memory, causing a NULL pointer dereference (accessing memory at address zero); it leaks refcounted memory (object references that are never properly freed); and it can access memory that has already been freed. The bugs occur when the decoder fails to properly clean up after errors in credential handling.
Solution / Mitigation
The fix involves four coordinated changes: (1) Move the oa->count = 1 assignment below the oa->data allocation so the counter is never set when data allocation fails. (2) Reset oa->count to 0 at the free_oa label to keep count and data coherent. (3) Call free_svc_cred(creds) before kfree(creds) at free_creds to properly release refcounted cr_group_info using its dedicated cleanup function instead of plain kfree. (4) In gssx_dec_linux_creds()'s out_free_groups path, release cr_group_info with put_group_info() instead of groups_free() and clear the pointer to prevent double-release by later cleanup code.
Vulnerability Details
EPSS: 0.0%
September 11, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-89544
First tracked: September 11, 2026 at 08:07 PM
Classified by LLM (prompt v3) · confidence: 95%