CVE-2025-71120
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel's SUNRPC subsystem, a NULL pointer dereference vulnerability was found in the gss_read_proxy_verf function. A zero-length GSS token results in empty memory pages, and accessing page_address(in_token->pages[0]) causes a NULL dereference even when the copy length is 0.
Risk Assessment
An attacker can send a specially crafted request with a zero-length GSS token, potentially causing a kernel panic and disrupting network services.
Recommendation
Immediately update the Linux kernel to a version that includes the fix guarding the first memcpy to only execute when length is greater than 0.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.