PT-2026-43737 · Linux+1 · Linux Kernel+1
CVE-2026-45870
·
Published
2026-05-27
·
Updated
2026-07-31
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
Memory leaks occur in the SUNRPC auth gss component during XDR decoding error paths. The functions
gssx dec ctx(), gssx dec status(), and gssx dec name() allocate memory using gssx dec buffer(), which utilizes kmemdup(). If a subsequent decode operation fails, these functions return immediately without freeing the previously allocated buffers. This is especially significant in gssx dec ctx() because the caller gssp accept sec context upcall() initializes several buffer length fields to non-zero values, such as exported context token.len, mech.len, src name.display name.len, and targ name.display name.len, leading to memory that remains unreferenced and cannot be reclaimed upon failure.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel