CVE-2026-93207

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody() entry

svcauthgssdecode_credbody() writes the caller's

rpcgsswirecred field by field and assigns gcctx.len only on

the success tail.  The caller storage is svcdata->clcred, which

lives in the per-svcrqst gsssvc_data and is reused across

requests.  Early decode failures leave partially decoded state

mixed with residue from the prior request.

The trailing body_len tightness check is the sharpest case:

xdrstreamdecodeopaqueinline() has already written gc_ctx.data

with a borrowed inline pointer into the current request's XDR

pages, but gc_ctx.len retains its prior value.  Once the request

pages are released the pooled clcred carries a dangling pointer

paired with a stale length.

Zero the caller's rpcgsswire_cred at function entry so that

every early-return path leaves a deterministic all-zero cred.

On the trailing tightness-check path, gc_ctx.len is now zero

instead of stale, which neuters length-driven consumers such as

gsssvcsearchbyctx() that would otherwise walk the dangling

data pointer.