# SUNRPC: harden gss_unwrap_resp_priv length checks

CVE record · `CVE-2026-89541`

- **Identifiers:** `CVE-2026-89541`
- **State:** Confirmed
- **Severity:** CVSS 9.8 Critical
- **Critical:** Yes: CVSS 9+
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 11 Sept 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:44 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Critical

Critical, because:

- CVSS score 9.8: 9.0 or more.

How we decide what’s critical: <https://agentprime.io/advisories/critical.md>

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 3691c4b3488d8ca046b9941e5be30c626dbbbb50` (git)
  - affected: `2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 85fa6b12e8f439739ac36ef2aad925f37c8b976a` (git)
  - affected: `2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 401f6a5b338d05bb1069ad814d9f77e3c367854f` (git)
  - affected: `2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 81fd7654a8429718adfcb2a7e03496077f547ed0` (git)
  - affected: `2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 89a15a50f84d32d4b99db86f957427fcbe20a99a` (git)
  - affected: `2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before ebcbd2523a8524c3d24e111cdbed8e271d910269` (git)
  - affected: `2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before d395c30d570ca6168f0297b191709927d1258273` (git)
  - affected: `2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 87831b92112c81db251d46756d65daa4f91af6a2` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `2.6.15`
  - unaffected: `before 2.6.15` (semver)
  - unaffected: `5.10.270 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.221 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.188 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.157 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.109 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.50 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.4 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 9.8 Critical, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0051, the 44th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-89541](https://www.cve.org/CVERecord?id=CVE-2026-89541)
- [NVD: CVE-2026-89541](https://nvd.nist.gov/vuln/detail/CVE-2026-89541)

### References from the CNA

- <https://git.kernel.org/stable/c/3691c4b3488d8ca046b9941e5be30c626dbbbb50>
- <https://git.kernel.org/stable/c/85fa6b12e8f439739ac36ef2aad925f37c8b976a>
- <https://git.kernel.org/stable/c/401f6a5b338d05bb1069ad814d9f77e3c367854f>
- <https://git.kernel.org/stable/c/81fd7654a8429718adfcb2a7e03496077f547ed0>
- <https://git.kernel.org/stable/c/89a15a50f84d32d4b99db86f957427fcbe20a99a>
- <https://git.kernel.org/stable/c/ebcbd2523a8524c3d24e111cdbed8e271d910269>
- <https://git.kernel.org/stable/c/d395c30d570ca6168f0297b191709927d1258273>
- <https://git.kernel.org/stable/c/87831b92112c81db251d46756d65daa4f91af6a2>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-89541>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-89541/>. Everything for agents: <https://agentprime.io/llms.txt>.