CVE-2026-45870

SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths

published May 27, 2026

CVSS
—
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths

The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name()

functions allocate memory via gssx_dec_buffer(), which calls

kmemdup(). When a subsequent decode operation fails, these

functions return immediately without freeing previously

allocated buffers, causing memory leaks.

The leak in gssx_dec_ctx() is particularly relevant because

the caller (gssp_accept_sec_context_upcall) initializes several

buffer length fields to non-zero values, resulting in memory

allocation:

struct gssx_ctx rctxh = {

.exported_context_token.len = GSSX_max_output_handle_sz,

.mech.len = GSS_OID_MAX_LEN,

.src_name.display_name.len = GSSX_max_princ_sz,

.targ_name.display_name.len = GSSX_max_princ_sz

};

If, for example, gssx_dec_name() succeeds for src_name but

fails for targ_name, the memory allocated for

exported_context_token, mech, and src_name.display_name

remains unreferenced and cannot be reclaimed.

Add error handling with goto-based cleanup to free any

previously allocated buffers before returning an error.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Published
2026-05-27T12:15Z
EPSS history
Timeline
  • 27 MAY 12:15Z
    SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
    cvelistv5