CVE-2026-45964
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path Commit 5940d1cf9f42 ("SUNRPC: Rebalance a kref in auth_gss.c") added a kref_get(&gss_auth->kref) call to balance the gss_put_auth() done in gss_release_msg(), but forgot to add a corresponding kref_put() on the error path when kstrdup_const() fails. If service_name is non-NULL and kstrdup_const() fails, the function jumps to err_put_pipe_version which calls put_pipe_version() and kfree(gss_msg), but never releases the gss_auth reference. This leads to a kref leak where the gss_auth structure is never freed. Add a forward declaration for gss_free_callback() and call kref_put() in the err_put_pipe_version error path to properly release the reference taken earlier.
Affected versions
Linux kernel versions
5.2
and later are affected. Fixed in
5.10.252,
5.15.202,
6.1.165,
6.6.128,
6.12.75,
6.18.14,
6.19.4,
7.0
and their respective stable series.
References
The following references provide additional information about CVE-2026-45964 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/3b2b6c42070ce4204936288253baf101e995c2d3
-
PatchKernel patch commithttps://git.kernel.org/stable/c/655c9ba9915f05266998dbbf4b76b3c79b8a70aa
-
PatchKernel patch commithttps://git.kernel.org/stable/c/a1bc9561b617ec7e2d09e6c134d1db8fcf9ca4a6
Frequently asked questions
-
What is CVE-2026-45964?
CVE-2026-45964 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.2 onward and has been patched in 5.10.252, 5.15.202, 6.1.165 and others. CVE-2026-45964 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-45964?
Yes — CVE-2026-45964 has been patched. Fixed versions include 5.10.252, 5.15.202, 6.1.165 and others. If you are running Linux kernel 5.2 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-45964 actively exploited?
No — CVE-2026-45964 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.