Linux Kernel CVE-2026-89537

Requires an NFS/SUNRPC deployment configured with Kerberos RPC security (RPCSEC_GSS, i.e. sec=krb5/krb5i/krb5p mounts) - the vulnerable gss_krb5_verify_mic_v2() path is not reached without it. For the client-side paths (gss_unwrap_resp_integ, gss_validate), a malicious or compromised NFS server can deliver the short MIC token without authenticating to the client; for the server-side paths (svcauth_gss_verify_header, svcauth_gss_unwrap_integ), the attacker must be a client able to reach RPCSEC_GSS header/integrity processing. Limiting factors: the flaw is inert on default NFS without Kerberos, requires the peer to send a crafted undersized token, and the realistic impact is a slab over-read (crash/limited adjacent-memory read) rather than reliable arbitrary disclosure.

The input CVSS 3.1 vector (9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates real-world risk in two ways. First, AC:L and the implied default reachability ignore that exploitation requires an NFS deployment configured with Kerberos security (sec=krb5 / RPCSEC_GSS) - a non-default, comparatively uncommon configuration - so AC:H is more honest. Second, C:H is aggressive for a small out-of-bounds slab read: the dominant outcome is a crash/DoS (consistent with A:H), with at most limited disclosure of adjacent slab contents, so C:L is more defensible than C:H. Corroborating signals point the same way: EPSS is 0.19% (9th percentile), the CVE is not in CISA KEV, and no public proof-of-concept is identified. This is a legitimate memory-safety fix worth patching on Kerberized NFS fleets, but it is not a drop-everything internet-wide priority; treat it as a config-gated, DoS-leaning issue rather than the 9.1 headline number suggests.

An attacker who controls or spoofs an NFS server that a Kerberos-secured (sec=krb5) client mounts returns an RPCSEC_GSS integrity reply containing a truncated MIC token whose checksum opaque is shorter than the enctype requires. The client's gss_unwrap_resp_integ() copies the short length into a small kmalloc'd buffer and passes it to gss_krb5_verify_mic_v2(), which reads past the allocation, likely crashing the client or reading adjacent slab data. No public exploit code is identified at time of analysis.