Linux Kernel EUVD-2026-85936

Requires the target Linux system to run an NFS server with RPCSEC_GSS/Kerberos security enabled (e.g. exports mounted with sec=krb5, krb5i, or krb5p); systems using only AUTH_SYS or no NFS server are not exposed. The attacker must be able to send RPC traffic to the GSS-enabled service and craft a credential body that fails XDR decode (notably the trailing body_len tightness check). Reliability is limited because the dangling pointer depends on residue from a prior request and the request XDR pages being released, making triggering a usable UAF non-deterministic (elevated attack complexity). Decode occurs during the GSS handshake, so no completed authentication is required, but the non-default kerberized-NFS configuration is the key limiting factor.

This is a Linux kernel SUNRPC server-side RPCSEC_GSS bug (svcauth_gss_decode_credbody) where early XDR decode failures leave the pooled per-svc_rqst clcred holding a dangling gc_ctx.data pointer (an inline pointer into the current request's XDR pages) paired with a stale gc_ctx.len from a prior request; a downstream length-driven consumer such as gss_svc_searchbyctx() then walks freed memory. The NVD score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is substantially overstated and typical of automated Linux kernel batch scoring. The realistic outcome is a use-after-free read that is crash-dominant (DoS), not reliable memory corruption yielding full confidentiality+integrity+availability compromise. AV:N and PR:N are defensible because the malformed credential body is decoded during the GSS handshake, effectively pre-authentication, and reachable over the network - BUT exploitation is gated on the NFS server actually having RPCSEC_GSS/Kerberos (sec=krb5*) enabled, and AC is realistically High because triggering a usable dangling pointer depends on cross-request state and the request pages being released with the right residue. There is no EPSS score, no CISA KEV listing, and no public exploit identified, so signals point to a low-urgency, defense-in-depth memory-safety fix rather than an actively exploited critical flaw. The CVSS AV:N conflicts with the practical requirement that only kerberized NFS servers are affected - verify your NFS deployment uses sec=krb5 before treating this as network-critical.

An attacker who can reach an NFS server configured with RPCSEC_GSS/Kerberos (sec=krb5*) sends a crafted RPC with a malformed GSS credential body that fails the trailing body_len tightness check during decode. The pooled clcred is left with a dangling data pointer and stale length, so a subsequent context lookup walks freed request-page memory, most likely crashing the server (DoS). No public proof-of-concept exists at time of analysis.