The Linux kernel's SUNRPC auth_gss module had a memory leak vulnerability (CVE-2026-45870) caused by missing cleanup in error paths during XDR decoding. Functions such as gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() allocate memory buffers using kmemdup() but do not free these buffers if a subsequent decode operation fails, resulting in memory leaks. The leak in gssx_dec_ctx() is notable because multiple buffers are allocated before failure can occur, leaving several buffers unreleased. The fix involves adding goto-based cleanup logic to free any previously allocated buffers before returning an error.

This vulnerability leads to memory leaks in the Linux kernel's SUNRPC auth_gss component. While it does not affect confidentiality or integrity, it impacts availability by causing resource exhaustion (memory consumption) over time. There are no known exploits in the wild. The CVSS vector indicates local attack vector with low privileges required and no user interaction, with no confidentiality or integrity impact but high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor for updates from the Linux kernel maintainers and apply patches once released. No specific workaround or temporary fix is provided in the available information.