Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail. The caller storage is svcdata->clcred, which lives in the per-svc_rqst gss_svc_data and is reused across requests. Early decode failures leave partially decoded state mixed with residue from the prior request. The trailing body_len tightness check is the sharpest case: xdr_stream_decode_opaque_inline() has already written gc_ctx.data with a borrowed inline pointer into the current request's XDR pages, but gc_ctx.len retains its prior value. Once the request pages are released the pooled clcred carries a dangling pointer paired with a stale length. Zero the caller's rpc_gss_wire_cred at function entry so that every early-return path leaves a deterministic all-zero cred. On the trailing tightness-check path, gc_ctx.len is now zero instead of stale, which neuters length-driven consumers such as gss_svc_searchbyctx() that would otherwise walk the dangling data pointer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-24T16:17:15.357Z",
  "pubdate": "2026-09-24T16:17:15.357Z",
  "executiveSummary": "This vulnerability involves a memory state corruption issue within the Linux kernel's SUNRPC implementation, specifically in the svcauth_gss_decode_credbody function.\nThe flaw manifests as an improper initialization of the rpc_gss_wire_cred structure, which is stored in a reused gss_svc_data buffer.\nFailure to zero-initialize this structure during early decoding stages leads to a condition where stale data and dangling pointers persist across sequential RPC requests.\nAn unauthenticated attacker capable of sending RPC requests can potentially trigger this state, leading to information disclosure or memory safety violations.\nThe risk is categorized as significant because it affects the integrity of RPC credential processing, which is central to Linux network service security.\nExploitation requires the ability to reach the decoding phase of an RPC GSS request, causing the kernel to operate on inconsistent or stale security context data.",
  "technicalDetails": "The root cause of the vulnerability lies in the non-atomic and conditional update of the rpc_gss_wire_cred structure within svcauth_gss_decode_credbody(). The function writes to the structure field-by-field, only updating the length (gc_ctx.len) upon successful parsing.\nBecause the storage for this structure (svcdata->clcred) is housed within a persistent per-svc_rqst gss_svc_data object, it is recycled across subsequent requests. When an early decoding error occurs, the structure retains remnants of previous RPC credentials, including pointers that no longer reference valid memory buffers.\nA critical path for this vulnerability exists in the handling of the XDR stream. Specifically, xdr_stream_decode_opaque_inline() may populate gc_ctx.data with a pointer to the current request's XDR pages before a subsequent length-check failure occurs. In this scenario, the function returns an error, but gc_ctx.len is not updated, retaining the value from a prior, successful request.\nFollowing the return, the kernel releases the request pages. This results in the cached clcred holding a 'dangling pointer' in gc_ctx.data paired with an outdated length field. Any subsequent function consuming this structure—such as gss_svc_searchbyctx()—will attempt to process the stale pointer.\nBecause the length field is not zeroed out, these consumers are 'tricked' into treating the dangling pointer as valid, potentially leading to unauthorized memory access or the interpretation of kernel stack/heap residue as legitimate RPC security context data.\nThe attack flow follows these steps: 1) The attacker initiates an RPC call containing a malformed GSS credential designed to trigger a specific decode failure after the inline pointer assignment. 2) The kernel partially populates the reused memory buffer and aborts. 3) The kernel releases the XDR pages while the buffer maintains the dangling reference. 4) The attacker or a subsequent system process triggers a function (e.g., gss_svc_searchbyctx()) that operates on the corrupted struct. 5) The system performs operations based on attacker-controlled stale data or invalid memory, facilitating an information leak or potential kernel crash."
}