{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-93207", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.093Z", "datePublished": "2026-09-24T15:10:30.942Z", "dateUpdated": "2026-10-19T09:07:19.480Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:07:19.480Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail. The caller storage is svcdata->clcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests. Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value. Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - A remote NFS/SUNRPC peer sends an RPC Call with flavor RPC_AUTH_GSS whose rpc_gss_cred_t fails the body_len tightness check in svcauth_gss_decode_credbody(); those cred bytes arrive on nfsd TCP/UDP 2049 via svc_recv → svc_tcp_recvfrom/svc_udp_recvfrom → svc_process → svc_process_common → svc_authenticate → svcauth_gss_accept.\nAC:L - The attacker first sends a well-formed RPCSEC_GSS cred so decode assigns gc_ctx.len, then a second Call where xdr_stream_decode_opaque_inline() succeeds but body_len != XDR_UNIT*5+xdr_align_size(handle_len). Both hit the same nfsd thread's reused gss_svc_data.clcred; the tightness failure is deterministic with no race.\nPR:N - svcauth_gss_decode_credbody() is the RPC_AUTH_GSS credential decoder inside svcauth_gss_accept(), reached before gss_svc_searchbyctx(), gss_verify_mic(), or nfsd export/client checks. Flavor 6 with auth_rpcgss registered (RPCSEC_GSS_KRB5 defaults y) needs no Kerberos ticket, uid, or capability.\nUI:N - nfsd processes each inbound RPC in the service thread via svc_process with no local user or administrator action; the attacker alone sends the residue-planting Call and the tightness-fail Call.\nS:U - The dangling gc_ctx pointer, consume_skb() of the UDP receive skb, and any later kmemdup of that pointer occur in the host nfsd/SUNRPC kernel. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - On tightness failure, xdr_stream_decode_opaque_inline() writes gc_ctx.data into the UDP in-place skb (svc_udp_recvfrom) while gc_ctx.len stays the prior handle length. svc_udp_release_ctxt() consume_skb() then frees that skb; gss_svc_searchbyctx()→dup_to_netobj() kmemdups handle->len bytes from the dangling pointer, a UAF read of reclaimed kernel memory.\nI:H - The leftover clcred.gc_ctx is a use-after-free of skb-backed memory with an attacker-chosen stale length planted by the prior GSS handle. Spraying the consumed skb lets length-driven consumers of that netobj treat attacker bytes as kernel objects, so integrity impact is High as for other kernel UAFs.\nA:H - Walking gc_ctx.data after consume_skb() oopses the nfsd thread when the skb is reused or unmapped, and the attacker can repeat tightness-fail Calls to kill service threads or panic the host where panic_on_oops is set." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sunrpc/auth_gss/svcauth_gss.c" ], "versions": [ { "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "56b29d62017c7dd1718d060dd5b3a2ce61095d0c", "status": "affected", "versionType": "git" }, { "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "0e18641708eaa8bc3c1ff338cd844aeadbd52bac", "status": "affected", "versionType": "git" }, { "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "e0778464049b0238f2915a40007a4154f86cf351", "status": "affected", "versionType": "git" }, { "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "0fa8a8acae57e6373962741d5b06d13f44aba6a9", "status": "affected", "versionType": "git" }, { "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "11539e8fcce0b0af062ae5fecf7b3676c2f7aeed", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sunrpc/auth_gss/svcauth_gss.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.109" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.50" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c" }, { "url": "https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac" }, { "url": "https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351" }, { "url": "https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9" }, { "url": "https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed" } ], "title": "SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry", "x_generator": { "engine": "bippy-1.2.0" } } } }