---
title: "CVE-2026-89537: Linux Kernel - Buffer Over-read"
description: "Linux kernel contains a buffer over-read vulnerability in SUNRPC gss_krb5_verify_mic_v2 caused by missing length checks on short RFC 4121 MIC tokens, letting malicious NFS servers cause out-of-bounds reads, exploit requires malicious NFS server."
url: https://panop.io/threat-heartbeat/CVE-2026-89537/
---

# CVE-2026-89537 Linux Kernel - Buffer Over-read

Linux kernel contains a buffer over-read vulnerability in SUNRPC gss\_krb5\_verify\_mic\_v2 caused by missing length checks on short RFC 4121 MIC tokens, letting malicious NFS servers cause out-of-bounds reads, exploit requires malicious NFS server.

CVSS base score 9.1 /10

Critical

CISA KEV

Not listed

Public exploit

None known

EPSS

0.54% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89537)

## Details

Type

Buffer Over-read

Impact

Information Disclosure, Denial Of Service

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Published

11 September 2026

Updated

15 October 2026

## Vendor fix

Update to the latest Linux kernel version containing the fix for SUNRPC gss\_krb5\_verify\_mic\_v2.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89537](https://nvd.nist.gov/vuln/detail/CVE-2026-89537)
- [https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab](https://git.kernel.org/stable/c/7a946b2e7207f968902f2147ab9b30726f82f7ab)
- [https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25](https://git.kernel.org/stable/c/b94f6719dcd9f7a609bc5f459f85795900e77d25)
- [https://git.kernel.org/stable/c/996dd15f60121bdd7896b4554458f8806d608063](https://git.kernel.org/stable/c/996dd15f60121bdd7896b4554458f8806d608063)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)