Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-89541

SUNRPC: harden gss_unwrap_resp_priv length checks

CVSS 9.8 CriticalCriticalEPSS 0.0051 · 44th percentile

Critical, because:

  • CVSS score 9.8: 9.0 or more.

How we decide what’s critical

Published by the CVE Program (CNA: Linux) at 11 Sept 2026, 19:44 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 3691c4b3488d8ca046b9941e5be30c626dbbbb50 git
  • affected 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 85fa6b12e8f439739ac36ef2aad925f37c8b976a git
  • affected 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 401f6a5b338d05bb1069ad814d9f77e3c367854f git
  • affected 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 81fd7654a8429718adfcb2a7e03496077f547ed0 git
  • affected 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 89a15a50f84d32d4b99db86f957427fcbe20a99a git
  • affected 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before ebcbd2523a8524c3d24e111cdbed8e271d910269 git
  • affected 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before d395c30d570ca6168f0297b191709927d1258273 git
  • affected 2d2da60c63b67174add32f06e8d54c3a0c5cd9cf to before 87831b92112c81db251d46756d65daa4f91af6a2 git
Other versions: unaffected
Linux Linux
  • affected 2.6.15
  • unaffected before 2.6.15 semver
  • unaffected 5.10.270 to 5.10.*, inclusive semver
  • unaffected 5.15.221 to 5.15.*, inclusive semver
  • unaffected 6.1.188 to 6.1.*, inclusive semver
  • unaffected 6.6.157 to 6.6.*, inclusive semver
  • unaffected 6.12.109 to 6.12.*, inclusive semver
  • unaffected 6.18.50 to 6.18.*, inclusive semver
  • unaffected 7.2.4 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-89541
CNA
Linux
Tags
Published
11 Sept 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
9.8 Critical 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0051, the 44th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 11 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.