CVE-2026-93207

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93207", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.093Z", "datePublished": "2026-09-24T15:10:30.942Z", "dateUpdated": "2026-10-19T09:07:19.480Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:07:19.480Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail. The caller storage is svcdata->clcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests. Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value. Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - A remote NFS/SUNRPC peer sends an RPC Call with flavor RPC_AUTH_GSS whose rpc_gss_cred_t fails the body_len tightness check in svcauth_gss_decode_credbody(); those cred bytes arrive on nfsd TCP/UDP 2049 via svc_recv \u2192 svc_tcp_recvfrom/svc_udp_recvfrom \u2192 svc_process \u2192 svc_process_common \u2192 svc_authenticate \u2192 svcauth_gss_accept.\nAC:L - The attacker first sends a well-formed RPCSEC_GSS cred so decode assigns gc_ctx.len, then a second Call where xdr_stream_decode_opaque_inline() succeeds but body_len != XDR_UNIT*5+xdr_align_size(handle_len). Both hit the same nfsd thread's reused gss_svc_data.clcred; the tightness failure is deterministic with no race.\nPR:N - svcauth_gss_decode_credbody() is the RPC_AUTH_GSS credential decoder inside svcauth_gss_accept(), reached before gss_svc_searchbyctx(), gss_verify_mic(), or nfsd export/client checks. Flavor 6 with auth_rpcgss registered (RPCSEC_GSS_KRB5 defaults y) needs no Kerberos ticket, uid, or capability.\nUI:N - nfsd processes each inbound RPC in the service thread via svc_process with no local user or administrator action; the attacker alone sends the residue-planting Call and the tightness-fail Call.\nS:U - The dangling gc_ctx pointer, consume_skb() of the UDP receive skb, and any later kmemdup of that pointer occur in the host nfsd/SUNRPC kernel. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - On tightness failure, xdr_stream_decode_opaque_inline() writes gc_ctx.data into the UDP in-place skb (svc_udp_recvfrom) while gc_ctx.len stays the prior handle length. svc_udp_release_ctxt() consume_skb() then frees that skb; gss_svc_searchbyctx()\u2192dup_to_netobj() kmemdups handle->len bytes from the dangling pointer, a UAF read of reclaimed kernel memory.\nI:H - The leftover clcred.gc_ctx is a use-after-free of skb-backed memory with an attacker-chosen stale length planted by the prior GSS handle. Spraying the consumed skb lets length-driven consumers of that netobj treat attacker bytes as kernel objects, so integrity impact is High as for other kernel UAFs.\nA:H - Walking gc_ctx.data after consume_skb() oopses the nfsd thread when the skb is reused or unmapped, and the attacker can repeat tightness-fail Calls to kill service threads or panic the host where panic_on_oops is set."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/auth_gss/svcauth_gss.c"], "versions": [{"version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "56b29d62017c7dd1718d060dd5b3a2ce61095d0c", "status": "affected", "versionType": "git"}, {"version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "0e18641708eaa8bc3c1ff338cd844aeadbd52bac", "status": "affected", "versionType": "git"}, {"version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "e0778464049b0238f2915a40007a4154f86cf351", "status": "affected", "versionType": "git"}, {"version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "0fa8a8acae57e6373962741d5b06d13f44aba6a9", "status": "affected", "versionType": "git"}, {"version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "lessThan": "11539e8fcce0b0af062ae5fecf7b3676c2f7aeed", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sunrpc/auth_gss/svcauth_gss.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c"}, {"url": "https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac"}, {"url": "https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351"}, {"url": "https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9"}, {"url": "https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed"}], "title": "SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sunrpc/auth_gss/svcauth_gss.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "56b29d62017c7dd1718d060dd5b3a2ce61095d0c", "status": "affected", "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "versionType": "git"}, {"lessThan": "0e18641708eaa8bc3c1ff338cd844aeadbd52bac", "status": "affected", "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "versionType": "git"}, {"lessThan": "e0778464049b0238f2915a40007a4154f86cf351", "status": "affected", "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "versionType": "git"}, {"lessThan": "0fa8a8acae57e6373962741d5b06d13f44aba6a9", "status": "affected", "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "versionType": "git"}, {"lessThan": "11539e8fcce0b0af062ae5fecf7b3676c2f7aeed", "status": "affected", "version": "b0bc53470d1af01f62a0fe2d405cf56477804863", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sunrpc/auth_gss/svcauth_gss.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail. The caller storage is svcdata->clcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests. Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value. Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer."}], "id": "CVE-2026-93207", "lastModified": "2026-10-19T10:17:11.487", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-24T16:17:15.357", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry", "id": "2540182", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540182"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail. The caller storage is svcdata->clcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests. Early decode failures leave partially decoded state\nmixed with residue from the prior request.\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value. Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer.", "A flaw was found in the Linux kernel's SUNRPC (Sun Remote Procedure Call) component. Improper handling of credential data during the decoding process can lead to a dangling pointer, a form of memory corruption. This issue may allow a remote attacker to cause a denial of service by triggering early decode failures, leading to incorrect state management and potentially system instability."], "name": "CVE-2026-93207", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93207\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93207\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93207.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0bc53470d1af01f62a0fe2d405cf56477804863,56b29d62017c7dd1718d060dd5b3a2ce61095d0c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0bc53470d1af01f62a0fe2d405cf56477804863,0e18641708eaa8bc3c1ff338cd844aeadbd52bac)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0bc53470d1af01f62a0fe2d405cf56477804863,e0778464049b0238f2915a40007a4154f86cf351)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0bc53470d1af01f62a0fe2d405cf56477804863,0fa8a8acae57e6373962741d5b06d13f44aba6a9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b0bc53470d1af01f62a0fe2d405cf56477804863,11539e8fcce0b0af062ae5fecf7b3676c2f7aeed)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T10:00:15.109375+00:00", "updated": "2026-10-02T04:30:07.794175+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}