OpenSSH GSSAPI Vulnerability Allow an Attacker to Crash SSH Child Processes

A significant vulnerability in the GSSAPI Key Exchange patch was applied by numerous Linux distributions on top of their OpenSSH packages.

The flaw, tracked as CVE-2026-3497, was uncovered by security researcher Jeremy Brown. It allows an attacker to crash SSH child processes reliably and potentially violates privilege separation boundaries, all with a single crafted network packet.

The vulnerability stems from a one-line code defect inside kexgsss.c, the server-side GSSAPI key exchange handler. A non-terminating function, sshpkt_disconnect(), was used in the default error-handling case where the process-terminating ssh_packet_disconnect() was actually intended.

Because sshpkt_disconnect() only queues a disconnect message and returns rather than halting execution, the error handler falls through into code that reads an uninitialized stack variable called recv_tok.

OpenSSH GSSAPI Vulnerability

The contents of that variable are then sent to the privileged monitor process over IPC and passed to gss_release_buffer(), which may call free() on a garbage pointer resulting in confirmed heap corruption.

Brown’s analysis classifies the bug under CWE-824 (access of an uninitialized pointer) and CWE-908 (use of an uninitialized resource). Key impact details include:

• A single crafted SSH packet of approximately 300 bytes is sufficient to trigger the flaw — no credentials required
• On x86_64 systems, exploitation produces SIGABRT (signal 6) or SIGSEGV (signal 11) with a 90-second SSH lockout
• Child process crashes are 100% reliable in tested configurations
• Up to 127KB of heap data can be transmitted to the root-level monitor process via the privsep IPC channel, representing a serious privilege separation boundary violation

The severity of the vulnerability varies considerably across distributions due to differing compiler options and optimization flags. Clang compiled with -O0 leaves a pointer value of 0xfffbe600 with a length of 4 bytes, while GCC compiled with -O2 -fno-stack-protector leaves a valid heap address with a length of 127,344 bytes.

An eight-build test matrix confirmed that recv_tok.value can range from NULL to stack addresses, heap addresses, or entirely unmapped memory regions.

Systems running Ubuntu and Debian OpenSSH servers with GSSAPIKeyExchange yes enabled are confirmed to be potentially affected. Because several different versions of the GSSAPI KEX patch are in circulation across the Linux ecosystem, the scope of impact likely extends beyond these two distributions.

The fix is straightforward: replace all three instances of sshpkt_disconnect() with ssh_packet_disconnect() at the server-side call sites within kexgsss.c. Ubuntu has already prepared a patch addressing this issue.

Administrators running OpenSSH with GSSAPI key exchange enabled should apply available distribution updates immediately or disable GSSAPIKeyExchange as a temporary mitigation.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.