Threats Tagged 'cve-2026-45870'

A memory leak vulnerability exists in the Linux kernel's SUNRPC auth_gss component due to improper cleanup in XDR decoding error paths. Specifically, functions gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() allocate memory but may return early on decode failures without freeing previously allocated buffers. This leads to unreclaimed memory, particularly in gssx_dec_ctx() where multiple buffers can be allocated before an error occurs. The issue has been fixed by adding error handling to free allocated buffers on failure.

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() functions allocate memory via gssx_dec_buffer(), which calls kmemdup(). When a subsequent decode operation fails, these functions return immediately without freeing previously allocated buffers, causing memory leaks. The leak in gssx_dec_ctx() is particularly relevant because the caller (gssp_accept_sec_context_upcall) initializes several buffer length fields to non-zero values, resulting in memory allocation: struct gssx_ctx rctxh = { .exported_context_token.len = GSSX_max_output_handle_sz, .mech.len = GSS_OID_MAX_LEN, .src_name.display_name.len = GSSX_max_princ_sz, .targ_name.display_name.len = GSSX_max_princ_sz }; If, for example, gssx_dec_name() succeeds for src_name but fails for targ_name, the memory allocated for exported_context_token, mech, and src_name.display_name remains unreferenced and cannot be reclaimed. Add error handling with goto-based cleanup to free any previously allocated buffers before returning an error.