CVE-2026-89539: SUNRPC: reject duplicate CREDS_VALUE options

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: reject duplicate CREDS_VALUE options

gssx_dec_option_array() walks the wire-supplied option array and, for
every entry whose name matches CREDS_VALUE, calls
gssx_dec_linux_creds() on the same struct svc_cred. That helper
unconditionally installs a fresh groups_alloc() result into
creds->cr_group_info without releasing whatever pointer was already
there:

    for (i = 0; i < count; i++) {
        ... decode name ...
        if (length == sizeof(CREDS_VALUE) &&
            memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {
            err = gssx_dec_linux_creds(xdr, creds);
            ...
        }
    }

A reply that carries two CREDS_VALUE entries therefore overwrites
cr_group_info on the second iteration and orphans the group_info
allocated by the first call. The earlier free_creds path only
releases the last cr_group_info via free_svc_cred(), so the first
allocation's refcount stays at one and its kvmalloc-backed storage
is leaked. No in-tree caller of gssp_accept_sec_context_upcall()
expects more than one CREDS_VALUE per reply.

Fix by tracking whether a CREDS_VALUE option has already been
decoded and returning -EINVAL on any subsequent match, so the
free_creds path releases the single group_info that was installed.

The Linux kernel CVE team has assigned CVE-2026-89539 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.10 with commit 1d658336b05f8697d6445834f8867f8ad5e4f735 and fixed in 6.12.109 with commit f615b884310bf82d0014e3b5a92eb9aa88146685
	Issue introduced in 3.10 with commit 1d658336b05f8697d6445834f8867f8ad5e4f735 and fixed in 6.18.50 with commit 7a1d0501cbb962beba23377035d667bf3c1726ee
	Issue introduced in 3.10 with commit 1d658336b05f8697d6445834f8867f8ad5e4f735 and fixed in 7.2.4 with commit 9d94f046b23de0f77849ea69133063c949297e30
	Issue introduced in 3.10 with commit 1d658336b05f8697d6445834f8867f8ad5e4f735 and fixed in 7.3-rc1 with commit 2e4ce62385c1b8a887c5370af058ac7b52a8eaf9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89539
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sunrpc/auth_gss/gss_rpc_xdr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f615b884310bf82d0014e3b5a92eb9aa88146685
	https://git.kernel.org/stable/c/7a1d0501cbb962beba23377035d667bf3c1726ee
	https://git.kernel.org/stable/c/9d94f046b23de0f77849ea69133063c949297e30
	https://git.kernel.org/stable/c/2e4ce62385c1b8a887c5370af058ac7b52a8eaf9