The Linux kernel's SUNRPC gssx XDR option-array decoder contained four coupled defects affecting error path handling: (1) gssx_dec_option_array() set oa->count to 1 before allocating oa->data, leading to a NULL dereference if allocation failed; (2) inconsistent resetting of oa->count and oa->data during error cleanup caused callers to trust invalid counts; (3) free_creds() leaked the refcounted cr_group_info due to improper freeing of svc_cred structures; (4) a latent use-after-free was introduced by calling free_svc_cred() after groups_free() without clearing pointers. The patch moves the count assignment after successful allocation, resets count to zero on free, calls free_svc_cred() before kfree() to properly release references, and replaces groups_free() with put_group_info() while clearing pointers to prevent double frees.

These bugs could cause kernel NULL pointer dereferences, memory leaks, and use-after-free conditions in the SUNRPC GSS security context acceptance code. This may lead to kernel instability or crashes. The defects affect error handling paths and reference counting in the kernel's RPC security subsystem. No known exploits in the wild have been reported.

A fix is available that addresses all four defects by correcting memory allocation order, reference counting, and cleanup logic. Users should apply the official Linux kernel patches that resolve CVE-2026-89544 to ensure these vulnerabilities are remediated.