CVE-2026-89539: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-89539DEBIAN-CVE-2026-89539
Published 11-09-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-89539 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.7% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 11
MGASA-2026-0506OPENSUSE-SU-2026:11880-1OPENSUSE-SU-2026:22091-1SUSE-SU-2026:24179-1SUSE-SU-2026:24181-1SUSE-SU-2026:24182-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDS_VALUE options gssx_dec_option_array() walks the wire-supplied option array and, for every entry whose name matches CREDS_VALUE, calls gssx_dec_linux_creds() on the same struct svc_cred. That helper unconditionally installs a fresh groups_alloc() result into creds->cr_group_info without releasing whatever pointer was already there: for (i = 0; i < count; i++) { ... decode name ... if (length == sizeof(CREDS_VALUE) && memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) { err = gssx_dec_linux_creds(xdr, creds); ... } } A reply that carries two CREDS_VALUE entries therefore overwrites cr_group_info on the second iteration and orphans the group_info allocated by the first call. The earlier free_creds path only releases the last cr_group_info via free_svc_cred(), so the first allocation's refcount stays at one and its kvmalloc-backed storage is leaked. No in-tree caller of gssp_accept_sec_context_upcall() expects more than one CREDS_VALUE per reply. Fix by tracking whether a CREDS_VALUE option has already been decoded and returning -EINVAL on any subsequent match, so the free_creds path releases the single group_info that was installed.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

0.00 pp

From 0.17% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 1d658336b05f8697d6445834f8867f8ad5e4f735, < 4b5ebb4f91a6152a0f7b1253f701197e5710d4da | ≥ 1d658336b05f8697d6445834f8867f8ad5e4f735, < f615b884310bf82d0014e3b5a92eb9aa88146685 | ≥ 1d658336b05f8697d6445834f8867f8ad5e4f735, < 7a1d0501cbb962beba23377035d667bf3c1726ee | ≥ 1d658336b05f8697d6445834f8867f8ad5e4f735, < 9d94f046b23de0f77849ea69133063c949297e30 | ≥ 1d658336b05f8697d6445834f8867f8ad5e4f735, < 2e4ce62385c1b8a887c5370af058ac7b52a8eaf9 | 3.10

3 vendors · 172 products

References

9 links