CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs

CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: fix gssx_dec_option_array error path bugs

Four coupled defects in the gssx XDR option-array decoder make the
error paths unsafe: a NULL deref in the caller, a refcount leak on
the decoded group_info, and a latent use-after-free that the leak
fix would otherwise expose.

gssx_dec_option_array() sets oa->count = 1 before allocating
oa->data.  If that allocation fails, -ENOMEM is returned with
oa->count == 1 and oa->data == NULL.  All other error paths jump
to free_oa: which frees oa->data and NULLs it but also leaves
oa->count == 1.  The caller trusts the count:

    gssp_accept_sec_context_upcall()
      gssx_dec_accept_sec_context()
        gssx_dec_option_array()        /* fails, count=1 data=NULL */
      data = res.options.data[0].value /* NULL deref */

Independently, free_creds: releases the partially decoded svc_cred
with a bare kfree(creds).  gssx_dec_linux_creds() installs a
groups_alloc() result into creds->cr_group_info; that object is
kvmalloc-backed and refcounted, and only put_group_info() reaches
kvfree().  A plain kfree(creds) drops the wrapper and leaks the
group_info allocation.

The natural fix for the leak is to call free_svc_cred(creds) before
kfree(creds), but free_svc_cred() invokes put_group_info() on
creds->cr_group_info unconditionally when non-NULL.  The existing
out_free_groups: path in gssx_dec_linux_creds() already called
groups_free() on that pointer without clearing it, so once
free_svc_cred() is wired in, the subsequent put_group_info() would
touch freed memory.

Fix all four together:

  - Move the oa->count = 1 assignment below the oa->data allocation
    so it is never set when oa->data is NULL.
  - Reset oa->count to 0 at free_oa: so count and data stay
    coherent and the caller sees an empty option array.
  - Call free_svc_cred(creds) before kfree(creds) at free_creds:
    so the refcounted cr_group_info is released.  free_svc_cred()
    either NULL-guards each field explicitly (cr_group_info has
    an if() check) or delegates to a helper that is NULL-safe
    itself (kfree for the string fields, gss_mech_put() which
    guards with if(gm) at gss_mech_switch.c:342), so it is safe
    to call on a partially decoded svc_cred where only
    cr_uid/cr_gid/cr_group_info have been written and everything
    else is zero from kzalloc.
  - In gssx_dec_linux_creds()'s out_free_groups: path, release
    cr_group_info with put_group_info() rather than groups_free()
    so the teardown matches free_svc_cred()'s refcount-aware path,
    and clear the pointer so a later free_svc_cred() on the same
    creds does not release it a second time.

The Linux kernel CVE team has assigned CVE-2026-89544 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.9 with commit 3cfcfc102a5e57b021b786a755a38935e357797d and fixed in 6.18.51 with commit 3ff45361e9469e85c0f86b8e7b82c63e50bab8ef
	Issue introduced in 6.9 with commit 3cfcfc102a5e57b021b786a755a38935e357797d and fixed in 7.2.4 with commit f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a
	Issue introduced in 6.9 with commit 3cfcfc102a5e57b021b786a755a38935e357797d and fixed in 7.3-rc1 with commit 5e9a94539b1ec17a89177d952badfd0d844d694a
	Issue introduced in 4.19.311 with commit b97c37978ca825557d331c9012e0c1ddc0e42364
	Issue introduced in 5.4.273 with commit bfa9d86d39a0fe4685f90c3529aa9bd62a9d97a8
	Issue introduced in 5.10.214 with commit bb336cd8d5ecb69c430ebe3e7bcff68471d93fa8
	Issue introduced in 5.15.153 with commit dd292e884c649f9b1c18af0ec75ca90b390cd044
	Issue introduced in 6.1.83 with commit 934212a623cbab851848b6de377eb476718c3e4c
	Issue introduced in 6.6.23 with commit 5e6013ae2c8d420faea553d363935f65badd32c3
	Issue introduced in 6.7.11 with commit 9806c2393cd2ab0a8e7bb9ffae02ce20e3112ec4
	Issue introduced in 6.8.2 with commit 996997d1fb2126feda550d6adcedcbd94911fc69

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89544
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sunrpc/auth_gss/gss_rpc_xdr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3ff45361e9469e85c0f86b8e7b82c63e50bab8ef
	https://git.kernel.org/stable/c/f85a83774d7f4e2ac71c0c384df0dfb6f7d0179a
	https://git.kernel.org/stable/c/5e9a94539b1ec17a89177d952badfd0d844d694a