The vulnerability in the Linux kernel's SUNRPC subsystem concerns the handling of Kerberos v2 wrap tokens in the gss_krb5_unwrap_v2() function. The function sets a logical buffer length and calls xdr_buf_trim() using a trim length derived from the 16-bit 'extra count' (ec) field in the token header. Although the ec field is authenticated, a valid GSS context holder can produce tokens with an ec value exceeding the plaintext length, which is structurally malformed per RFC 4121. Previously, xdr_buf_trim() could cause an inconsistent buffer state by trimming beyond valid data. The patch rejects such oversized ec tokens before trimming, returning a GSS_S_DEFECTIVE_TOKEN error and maintaining buffer consistency.

The vulnerability could cause the SUNRPC subsystem to process structurally malformed Kerberos v2 tokens with oversized ec fields, leading to semantically invalid buffer states. This may result in inconsistent internal buffer handling, potentially causing unexpected behavior in the kernel's RPC authentication processing. No specific exploit or active exploitation is reported.

A fix has been applied to reject Kerberos v2 wrap tokens with oversized ec fields before buffer trimming occurs, returning a defined error and preserving buffer integrity. Users should apply the official Linux kernel update that includes this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.