The Linux kernel vulnerability CVE-2026-89541 affects the SUNRPC subsystem's gss_unwrap_resp_priv() function. The original length check uses a single combined condition that sums two u32 values (offset and opaque_len), which can overflow and bypass bounds checking. This allows a crafted RPCSEC_GSS reply with an opaque_len near 0xffffffff to cause the sum to wrap around, passing the check incorrectly and leading to gss_unwrap() being called with invalid parameters (end < begin). Additionally, the check lacks a lower bound on opaque_len, permitting small values that cause out-of-bounds reads in gss_krb5_unwrap_v2(). The vulnerability enables a malicious krb5p NFS server to induce out-of-bounds reads on the client side. The patch replaces the single check with three separate guards that safely handle u32 arithmetic and enforce the RFC 4121 minimum token length, preventing the overflow and invalid memory access.

An attacker controlling a krb5p NFS server can send a crafted RPCSEC_GSS reply that triggers out-of-bounds reads in the client's gss_krb5_unwrap_v2() function. This could potentially lead to information disclosure or client instability due to memory corruption. The vulnerability affects the client-side processing of RPCSEC_GSS replies in the Linux kernel's SUNRPC subsystem.

A fix has been implemented that replaces the vulnerable single combined length check with three separate bounds checks that prevent integer overflow and enforce minimum token length requirements. Users should apply the official Linux kernel updates that include this patch to mitigate the vulnerability. No additional mitigations are indicated or required beyond applying the fix.