External risk intelligence

Linux Kernel SUNRPC RFC 4121 MIC Token Parsing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-89537

The vulnerability affects Linux kernel SUNRPC Kerberos GSS-API authentication. While NFS services using this mechanism can be internet-exposed, they are typically restricted to internal or private networks. Exploitation requires specific, non-default network configurations, making public exposure possible but not standard or intended for internet-facing systems.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the Linux kernel related to how it handles authentication tokens for Kerberos. This flaw could allow for potential system compromise.

Input validation weakness in authentication.
Affects systems using Kerberos authentication.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could potentially target a Linux system by sending specially crafted, short network tokens to the SUNRPC service. This could cause the Kerberos GSS-API authentication mechanism to misinterpret the token's length, leading to an out-of-bounds read when verifying the message integrity. Successful exploitation might allow an attacker to trigger a denial-of-service condition or potentially gain unauthorized access to sensitive information.

Entry condition: Network access to a system running the vulnerable Linux kernel.
Trigger point: Processing of a short RFC 4121 MIC token.
Resulting risk: Potential denial of service or information disclosure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's SUNRPC component could allow a malicious NFS server to send malformed tokens. When these tokens are processed by the Kerberos Message Integrity Check (MIC) verifier, the system may perform out-of-bounds reads, potentially leading to denial of service or information disclosure. This could occur when Kerberos GSS-API authentication is used for RPC services, such as NFS, particularly when these services are exposed to a potentially untrusted network.

System integrity and confidentiality.
Malformed tokens processed by the verifier.
Denial of service or information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's SUNRPC implementation requires infrastructure or platform teams to investigate the presence and reachability of affected NFS services. Confirming the business criticality of these services and identifying the accountable owner is the immediate first step. Planning remediation based on the assessed risk will then dictate subsequent actions, potentially involving vendor coordination or temporary risk reduction measures if immediate patching is not feasible.

Infrastructure and platform teams own this.
Verify NFS service reachability and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SUNRPC component affected by CVE-2026-89537?

The Linux kernel SUNRPC component facilitates Remote Procedure Call communication, essential for services like NFS (Network File System) that allow servers and clients to share files. It handles GSS-API authentication, which uses Kerberos to secure these connections. This specific vulnerability occurs within the kernel code responsible for verifying Kerberos Message Integrity Check (MIC) tokens, which ensure that the data exchanged between the client and server has not been tampered with during transmission.

How does this vulnerability manifest as an out-of-bounds read?

The issue is an input validation error where the system fails to check if a received authentication token meets the minimum size requirements before processing it. By sending a malformed, shorter-than-expected RFC 4121 token, an attacker can trick the system into performing operations on insufficient data. Because the kernel does not verify the length first, it attempts to read memory beyond the allocated buffer, which constitutes an out-of-bounds read flaw.

What triggers the vulnerability in the Kerberos authentication process?

The vulnerability is triggered when the kernel's GSS-API verifier receives and processes a network token that is shorter than the expected header and checksum length. It is important to note that standard, well-formed tokens generated by legitimate Kerberos services are not affected because they consistently include the correct required byte length. The bug is specifically activated by malformed traffic that bypasses standard length-checking expectations.

Is my system at risk if it uses NFS services on a private network?

Halo Surface Signal identifies this as a possible risk. While the vulnerability requires network access to the SUNRPC service, NFS services are typically confined to private or internal networks. Although public exposure is possible, it is not standard practice. You should focus on identifying if your Linux systems are running NFS with Kerberos authentication and evaluate whether those specific services are reachable from untrusted network segments.

What are the first steps to address CVE-2026-89537?

Your priority is to identify which Linux systems in your environment are actively running NFS or other RPC services configured with Kerberos authentication. Once these assets are located, determine their business criticality and network reachability. Coordinate with your platform teams to assess the risk and prepare for updates. If immediate patching is not possible, investigate if you can temporarily restrict network access to those specific services as a defensive measure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.