CVE-2026-93207

CVEs › CVE-2026-93207

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail. The caller storage is svcdata->clcred, which lives in the per-svc_rqst gss_svc_data and is reused across requests. Early decode failures leave partially decoded state mixed with residue from the prior request. The trailing body_len tightness check is the sharpest case: xdr_stream_decode_opaque_inline() has already written gc_ctx.data with a borrowed inline pointer into the current request's XDR pages, but gc_ctx.len retains its prior value. Once the request pages are released the pooled clcred carries a dangling pointer paired with a stale length. Zero the caller's rpc_gss_wire_cred at function entry so that every early-return path leaves a deterministic all-zero cred. On the trailing tightness-check path, gc_ctx.len is now zero instead of stale, which neuters length-driven consumers such as gss_svc_searchbyctx() that would otherwise walk the dangling data pointer.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: CRITICAL
CVSS score: 9.8 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Effective score: 9.8 / 10 CRITICAL source: CNA overview
CWE(s): —
Reserved: 2026-09-17
Published: 2026-09-24 15:10 UTC
Last updated: 2026-09-25 05:09 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93207.json
Linked Threat: CVE-2026-93207 — SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

NVD / KEV / EPSS data refreshed 2026-09-25 04:32 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85936
Assigner: Linux
Published: Sep 24, 2026, 3:10:30 PM
Updated: Sep 25, 2026, 5:09:43 AM
EUVD base score (CVSS 3.1): 9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.0000
Vendors: Linux
Products: Linux (b0bc53470d1af01f62a0fe2d405cf56477804863 <0e18641708eaa8bc3c1ff338cd844aeadbd52bac)

Linux (patch: 6.12.109)

Linux (patch: 7.3-rc1)

Linux (patch: 6.6.157)

Linux (b0bc53470d1af01f62a0fe2d405cf56477804863 <11539e8fcce0b0af062ae5fecf7b3676c2f7aeed)

Linux (b0bc53470d1af01f62a0fe2d405cf56477804863 <e0778464049b0238f2915a40007a4154f86cf351)

Linux (patch: 0)

Linux (b0bc53470d1af01f62a0fe2d405cf56477804863 <0fa8a8acae57e6373962741d5b06d13f44aba6a9)

Linux (6.3)

Linux (patch: 7.2.4)

Linux (patch: 6.18.50)

Linux (b0bc53470d1af01f62a0fe2d405cf56477804863 <56b29d62017c7dd1718d060dd5b3a2ce61095d0c)
Aliases: GHSA-hcpq-g756-q7pv

ENISA description: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail. The caller storage is svcdata->clcred, which lives in the per-svc_rqst gss_svc_data and is reused across requests. Early decode failures leave partially decoded state mixed with residue from the prior request. The trailing body_len tightness check is the sharpest case: xdr_stream_decode_opaque_inline() has already written gc_ctx.data with a borrowed inline pointer into the current request's XDR pages, but gc_ctx.len retains its prior value. Once the request pages are released the pooled clcred carries a dangling pointer paired with a stale length. Zero the caller's rpc_gss_wire_cred at function entry so that every early-return path leaves a deterministic all-zero cred. On the trailing tightness-check path, gc_ctx.len is now zero instead of stale, which neuters length-driven consumers such as gss_svc_searchbyctx() that would otherwise walk the dangling data pointer.

EUVD references (5)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`b0bc53470d1af01f62a0fe2d405cf56477804863` (affected), `b0bc53470d1af01f62a0fe2d405cf56477804863` (affected), `b0bc53470d1af01f62a0fe2d405cf56477804863` (affected), `b0bc53470d1af01f62a0fe2d405cf56477804863` (affected), `b0bc53470d1af01f62a0fe2d405cf56477804863` (affected)	—
Linux	Linux	`6.3` (affected), `0` (unaffected), `6.6.157` (unaffected), `6.12.109` (unaffected), `6.18.50` (unaffected), `7.2.4` (unaffected), `7.3-rc1` (unaffected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (16)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft and Adobe Patch Tuesday, September 2026 Security Update ...

web:blog.qualys.com

Microsoft kicks off September with its monthly Patch Tuesday release, delivering fixes for security vulnerabilities affecting its products. The security updates are packed with security fixes…

2026-09-25 10:45 UTC
Marklogic Critical Security Alert Bulletin - August 2026 - (CVE-2026 ...

web:community.progress.com

CVE - 2026 -7326 — CWE-352: Cross-Site Request Forgery (CSRF) In Progress MarkLogic Server before 11.3.6 and before 12.0.3, a remote attacker who lures a currently authenticated administrator to a malicious page can cause administrative actions to be performed on the administrator's behalf without their knowledge, which may result in unauthorized changes to security configuration.

2026-09-25 10:45 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-25 10:45 UTC
Cisco Advance Notification for Publication of September 16, 2026 ...

web:sec.cloudapps.cisco.com

On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...

2026-09-25 10:45 UTC
SAP Security Patch Day - July 2026

web:support.sap.com

On 14 th of July 2026 , SAP security patch day saw the release of 16 new security notes and 1 Github security advisory. There are 3 updates to previously released security notes.

2026-09-25 10:45 UTC
September 2026 Patch Tuesday: CISO Executive Summary

web:www.action1.com

This CISO-focused summary highlights the vulnerabilities and critical infrastructure risks that should take priority for remediation following Microsoft's September 2026 Patch Tuesday release.

2026-09-25 10:45 UTC
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's September 2026 Patch Tuesday, with security updates released for a record-breaking 966 flaws, including two actively exploited zero-day vulnerabilities.

2026-09-25 10:45 UTC
Security Bulletin: IBM MQ is affected by multiple vulnerabilities in ...

web:www.ibm.com

Multiple issues were identified with IBM WebSphere Application Server Liberty, which IBM MQ ships and uses to supply IBM MQ Console and IBM MQ REST API functionality.

2026-09-25 10:45 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-25 10:45 UTC
How To Fix HDO Box Initializing Player Problem (Easy Guide)

web:www.youtube.com

© 2026 Google LLC

2026-09-25 10:45 UTC
Microsoft Update Catalog

web:catalog.update.microsoft.com

Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback

2026-09-25 15:07 UTC
CVE-2026-93207: Linux Vulnerability (CVSS 9.8) | CVETodo

web:cvetodo.com

CVE-2026-93207 is a CVSS 9.8 critical-severity vulnerability in Linux. See exploitation status, patch guidance, and technical details.

2026-09-25 15:07 UTC
Patch Management and Mitigation Supported Product Versions

web:docs.qualys.com

Supported Product Versions and Operating Systems Learn more about the products and operating system versions that are supported for Qualys Patch Management and Mitigation . Supported Windows Products Supported Windows Operating Systems Supported Linux Operating Systems Supported Mac Products

2026-09-25 15:07 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Access Microsoft Security Response Center's guide to address vulnerabilities, manage security risks, and keep your systems protected with the latest updates.

2026-09-25 15:07 UTC
Security Bulletin: IBM WebSphere Application Server and WebSphere ...

web:www.ibm.com

Remediation /Fixes IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH71631 and PH71370. To determine if a feature is enabled for WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature.

2026-09-25 15:07 UTC
I Can't Fix You X You Belong Here Hyperpop Remix - YouTube

web:www.youtube.com

hihihihihihihiThis song is also known as "I can't fix you mashup remix"this got a lot of views on tiktok so imma upload it herecan't put links since this is ...

2026-09-25 15:07 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-93207.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/svcauth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "56b29d62017c7dd1718d060dd5b3a2ce61095d0c",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            },
            {
              "lessThan": "0e18641708eaa8bc3c1ff338cd844aeadbd52bac",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            },
            {
              "lessThan": "e0778464049b0238f2915a40007a4154f86cf351",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            },
            {
              "lessThan": "0fa8a8acae57e6373962741d5b06d13f44aba6a9",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            },
            {
              "lessThan": "11539e8fcce0b0af062ae5fecf7b3676c2f7aeed",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/svcauth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail.  The caller storage is svcdata->clcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests.  Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value.  Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote NFS/SUNRPC peer sends an RPC Call with flavor RPC_AUTH_GSS whose rpc_gss_cred_t fails the body_len tightness check in svcauth_gss_decode_credbody(); those cred bytes arrive on nfsd TCP/UDP 2049 via svc_recv \u2192 svc_tcp_recvfrom/svc_udp_recvfrom \u2192 svc_process \u2192 svc_process_common \u2192 svc_authenticate \u2192 svcauth_gss_accept.\nAC:L - The attacker first sends a well-formed RPCSEC_GSS cred so decode assigns gc_ctx.len, then a second Call where xdr_stream_decode_opaque_inline() succeeds but body_len != XDR_UNIT*5+xdr_align_size(handle_len). Both hit the same nfsd thread's reused gss_svc_data.clcred; the tightness failure is deterministic with no race.\nPR:N - svcauth_gss_decode_credbody() is the RPC_AUTH_GSS credential decoder inside svcauth_gss_accept(), reached before gss_svc_searchbyctx(), gss_verify_mic(), or nfsd export/client checks. Flavor 6 with auth_rpcgss registered (RPCSEC_GSS_KRB5 defaults y) needs no Kerberos ticket, uid, or capability.\nUI:N - nfsd processes each inbound RPC in the service thread via svc_process with no local user or administrator action; the attacker alone sends the residue-planting Call and the tightness-fail Call.\nS:U - The dangling gc_ctx pointer, consume_skb() of the UDP receive skb, and any later kmemdup of that pointer occur in the host nfsd/SUNRPC kernel. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - On tightness failure, xdr_stream_decode_opaque_inline() writes gc_ctx.data into the UDP in-place skb (svc_udp_recvfrom) while gc_ctx.len stays the prior handle length. svc_udp_release_ctxt() consume_skb() then frees that skb; gss_svc_searchbyctx()\u2192dup_to_netobj() kmemdups handle->len bytes from the dangling pointer, a UAF read of reclaimed kernel memory.\nI:H - The leftover clcred.gc_ctx is a use-after-free of skb-backed memory with an attacker-chosen stale length planted by the prior GSS handle. Spraying the consumed skb lets length-driven consumers of that netobj treat attacker bytes as kernel objects, so integrity impact is High as for other kernel UAFs.\nA:H - Walking gc_ctx.data after consume_skb() oopses the nfsd thread when the skb is reused or unmapped, and the attacker can repeat tightness-fail Calls to kill service threads or panic the host where panic_on_oops is set."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:09:43.393Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed"
        }
      ],
      "title": "SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93207",
    "datePublished": "2026-09-24T15:10:30.942Z",
    "dateReserved": "2026-09-17T16:02:15.093Z",
    "dateUpdated": "2026-09-25T05:09:43.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}