{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-89538",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-89538",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-11T19:44:15.953Z",
    "updatedAt": "2026-10-19T08:48:29.976Z",
    "importedAt": "2026-10-24T01:58:35.090Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Reject krb5 v2 wrap tokens with oversized ec field\n\ngss_krb5_unwrap_v2() sets buf->len to a logical\nlength, which can be much smaller than head[0].iov_len\n(the allocated receive-page capacity).  It then calls\nxdr_buf_trim() with a trim length derived from the 16-bit\n\"extra count\" (ec) field in the Kerberos v2 token header.\n\nThe ec field is authenticated by the post-decrypt memcmp()\nagainst the encrypted header copy, so a randomly-mutated\nvalue is rejected.  However, any peer holding a valid GSS\ncontext can legitimately encrypt a token whose ec exceeds\nthe plaintext length.  Per RFC 4121, such a token is\nstructurally malformed.\n\nAlthough xdr_buf_trim() now clamps the buf->len subtraction\nto avoid unsigned underflow, the buffer is still left in a\nsemantically invalid state (zero length, inconsistent iov\nlengths) when ec is oversized.\n\nReject these tokens before calling xdr_buf_trim(), giving\ncallers a well-defined GSS_S_DEFECTIVE_TOKEN error and\nkeeping the xdr_buf internally consistent.  The wrapped blob\nbegins at a nonzero offset -- both callers pass len as\noffset + opaque_len -- so buf->len still counts the offset\nbytes that precede the blob.  Compare the trim length\nagainst the remaining wrapped segment, buf->len - offset,\nrather than the whole buffer; comparing against buf->len\nalone leaves an offset-wide window in which an oversized ec\npasses the test and xdr_buf_trim() cuts into the bytes ahead\nof the blob.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "cf4c024b908353fcc48309374d39e3399d67dfd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ac9efc29346b6942e71f0e24a3178a9121330fab"
            },
            {
              "version": "cf4c024b908353fcc48309374d39e3399d67dfd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b5746095b59f4d11f39f08751d36bbdfd1e5deac"
            },
            {
              "version": "cf4c024b908353fcc48309374d39e3399d67dfd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9fc6d6e6db49ab55208d5dd1c424c1d0d9aa7296"
            },
            {
              "version": "cf4c024b908353fcc48309374d39e3399d67dfd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4abb44a29bb515df6f49123848765c70fc9b5021"
            },
            {
              "version": "cf4c024b908353fcc48309374d39e3399d67dfd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "dfcd81ab45613d45996fbf483d4ef54b0ec90ab9"
            },
            {
              "version": "cf4c024b908353fcc48309374d39e3399d67dfd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1f9856af065b6158271687e9788407b9573fd16f"
            },
            {
              "version": "cf4c024b908353fcc48309374d39e3399d67dfd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "880effc943ed82d6811f272ed3307c222b40f4d6"
            },
            {
              "version": "cf4c024b908353fcc48309374d39e3399d67dfd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ad484748eec0a66eac0f13ab53b3fbedb7333c91"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.13",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "3.13"
            },
            {
              "version": "5.10.270",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.221",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.188",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.157",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.109",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.50",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.2.4",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}