- Critical 9.8
CVE-2026-93207
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail. The caller storage is svcdata-clcred, which lives in the per-svc_rqst gss_svc_data and is reused across requests. Early decode failures leave partially decoded state mixed with residue from the prior request. The trailing body_len tightness check is the sharpest case: xdr_stream_decode_opaque_inline() has already written gc_ctx…
Scores
The facts
- Published
- 24 September 2026
- Last changed
- 25 September 2026
- NVD status
- Received
- Severity
- Critical, CVSS 9.8 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited
- Not in the CISA Known Exploited Vulnerabilities catalogue in this build.
- EPSS
- 0.5% chance of exploitation activity in the next 30 days (percentile 39).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.
References
- git.kernel.org/…/0e18641708eaa8bc3c1ff338cd844aeadbd52bac
- git.kernel.org/…/0fa8a8acae57e6373962741d5b06d13f44aba6a9
- git.kernel.org/…/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed
- git.kernel.org/…/56b29d62017c7dd1718d060dd5b3a2ce61095d0c
- git.kernel.org/…/e0778464049b0238f2915a40007a4154f86cf351
- CVE-2026-93207 in the NVD