{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"c81431b1b9fbd21e9a5a9211b5517b7295d18e6a","status":"affected","version":"1d658336b05f8697d6445834f8867f8ad5e4f735","versionType":"git"},{"lessThan":"caf7eff432e91a9eba1c79fa545c2f54be15d62b","status":"affected","version":"1d658336b05f8697d6445834f8867f8ad5e4f735","versionType":"git"},{"lessThan":"64303b92d94c0c7845a273acd8d84b796d6f1db7","status":"affected","version":"1d658336b05f8697d6445834f8867f8ad5e4f735","versionType":"git"},{"lessThan":"df10f23defff22c8d55fe6db74f6e4ce927145bf","status":"affected","version":"1d658336b05f8697d6445834f8867f8ad5e4f735","versionType":"git"},{"lessThan":"b4af3806846778799cd4ab0766dc18341e777264","status":"affected","version":"1d658336b05f8697d6445834f8867f8ad5e4f735","versionType":"git"},{"lessThan":"d79b9097a6a2b91471b40755f1225364be5d85ff","status":"affected","version":"1d658336b05f8697d6445834f8867f8ad5e4f735","versionType":"git"},{"lessThan":"3b56eb90feb8a3709417f5624f3871847d42bcb1","status":"affected","version":"1d658336b05f8697d6445834f8867f8ad5e4f735","versionType":"git"},{"lessThan":"3e6397b056335cc56ef0e9da36c95946a19f5118","status":"affected","version":"1d658336b05f8697d6445834f8867f8ad5e4f735","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"3.10"},{"lessThan":"3.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.14","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-45870","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: auth_gss: fix memory leaks in XDR decoding error paths\n\nThe gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name()\nfunctions allocate memory via gssx_dec_buffer(), which calls\nkmemdup(). When a subsequent decode operation fails, these\nfunctions return immediately without freeing previously\nallocated buffers, causing memory leaks.\n\nThe leak in gssx_dec_ctx() is particularly relevant because\nthe caller (gssp_accept_sec_context_upcall) initializes several\nbuffer length fields to non-zero values, resulting in memory\nallocation:\n\n    struct gssx_ctx rctxh = {\n        .exported_context_token.len = GSSX_max_output_handle_sz,\n        .mech.len = GSS_OID_MAX_LEN,\n        .src_name.display_name.len = GSSX_max_princ_sz,\n        .targ_name.display_name.len = GSSX_max_princ_sz\n    };\n\nIf, for example, gssx_dec_name() succeeds for src_name but\nfails for targ_name, the memory allocated for\nexported_context_token, mech, and src_name.display_name\nremains unreferenced and cannot be reclaimed.\n\nAdd error handling with goto-based cleanup to free any\npreviously allocated buffers before returning an error.","epss":{"date":"2026-11-06","percentile":0.05271,"score":0.0016},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793980389788,"publishedAt":1779884150199,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/c81431b1b9fbd21e9a5a9211b5517b7295d18e6a"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/caf7eff432e91a9eba1c79fa545c2f54be15d62b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/64303b92d94c0c7845a273acd8d84b796d6f1db7"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/df10f23defff22c8d55fe6db74f6e4ce927145bf"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b4af3806846778799cd4ab0766dc18341e777264"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d79b9097a6a2b91471b40755f1225364be5d85ff"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/3b56eb90feb8a3709417f5624f3871847d42bcb1"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/3e6397b056335cc56ef0e9da36c95946a19f5118"}],"remediation":[],"revision":"d005fca29ca48dd870ba9acdecd49e59b3074baa5091a988e3770fc141540d8a","sources":[{"modifiedAt":1793980389788,"name":"CNA: Linux","retrievedAt":1793981754185,"url":"https://www.cve.org/CVERecord?id=CVE-2026-45870"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793981758253,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-45870"}],"ssvc":{"assessedAt":1793979775762,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths","updatedAt":1793981758253}