The Linux kernel's SUNRPC implementation had a vulnerability in the gss_krb5_unwrap_v2() function where it read EC and RRC header fields at offsets ptr+4 and ptr+6 without first confirming the token length was at least 16 bytes. This led to out-of-bounds reads on short tokens. Additionally, the rotate_left() helper passed a calculated base offset to xdr_buf_subsegment() without verifying base was within buffer length, causing unsigned integer wrap and potential divide-by-zero errors. The cleanup code contained a BUG_ON() check that was logically dead and could not detect unsigned underflow, resulting in a large memmove() with an incorrect size. The patch introduced four defense-in-depth guards: rejecting tokens shorter than the header length, early returns in rotate_left() and _rotate_left() to prevent faults, and replacing the dead BUG_ON() with a live check returning an error code.

The vulnerability could lead to out-of-bounds memory reads and unsafe memory operations within the kernel, potentially causing memory corruption or kernel crashes. The presence of a large memmove() with an incorrect size due to unsigned underflow could destabilize the system. However, no known exploits in the wild have been reported.

A fix has been implemented that adds multiple defensive checks inside the gss_krb5_unwrap_v2 core function to ensure safe operation regardless of caller validation. Users should update to the patched Linux kernel version containing these fixes once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.