The Linux kernel's SUNRPC component had a vulnerability where the gssx_dec_option_array() function processed each CREDS_VALUE option in a reply by calling gssx_dec_linux_creds(), which allocates and installs group credential information. If multiple CREDS_VALUE options were present, the second call would overwrite the cr_group_info pointer without freeing the first allocation, causing a memory leak. The free_creds path only frees the last cr_group_info, leaving the first allocation's reference count at one and leaking kernel memory. The fix tracks whether a CREDS_VALUE option has already been decoded and returns -EINVAL on duplicates, preventing multiple installations and ensuring proper cleanup.

This vulnerability leads to a kernel memory leak when a reply contains multiple CREDS_VALUE options. While no direct exploitation or active attacks are reported, the leak could degrade system stability or be leveraged in complex attack scenarios involving resource exhaustion. No evidence of in-the-wild exploitation is known.

A fix has been implemented in the Linux kernel to reject duplicate CREDS_VALUE options and properly manage memory allocations. Users should apply the official kernel update that includes this patch once available. Patch status is not explicitly stated in the provided data; therefore, check the vendor advisory for current remediation guidance.