CVE-2025-71120

SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

State: Published
Severity: 7.5 High
Published: Jan 14, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	5866efa8cbfbadf3905072798e96652faf02dbe8 to before a8f1e445ce3545c90d69c9e8ff8f7821825fe810Affected 5866efa8cbfbadf3905072798e96652faf02dbe8 to before 4dedb6a11243a5c9eb9dbb97bca3c98bd725e83dAffected 5866efa8cbfbadf3905072798e96652faf02dbe8 to before f9e53f69ac3bc4ef568b08d3542edac02e83fefdAffected 5866efa8cbfbadf3905072798e96652faf02dbe8 to before 7452d53f293379e2c38cfa8ad0694aa46fc4788bAffected 5866efa8cbfbadf3905072798e96652faf02dbe8 to before a2c6f25ab98b423f99ccd94874d655b8bcb01a19Affected 5866efa8cbfbadf3905072798e96652faf02dbe8 to before 1c8bb965e9b0559ff0f5690615a527c30f651dd8Affected 5866efa8cbfbadf3905072798e96652faf02dbe8 to before d4b69a6186b215d2dc1ebcab965ed88e8d41768dAffected 66ed7b413d31c6ff23901ac4443b1cc1af2f6113Affected 7be8c165dc81564705e8e0b72d398ef708f67eaaAffected 4.19.99 to before 4.20Affected 5.4.15 to before 5.5Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

5866efa8cbfbadf3905072798e96652faf02dbe8 to before a8f1e445ce3545c90d69c9e8ff8f7821825fe810Affected
5866efa8cbfbadf3905072798e96652faf02dbe8 to before 4dedb6a11243a5c9eb9dbb97bca3c98bd725e83dAffected
5866efa8cbfbadf3905072798e96652faf02dbe8 to before f9e53f69ac3bc4ef568b08d3542edac02e83fefdAffected
5866efa8cbfbadf3905072798e96652faf02dbe8 to before 7452d53f293379e2c38cfa8ad0694aa46fc4788bAffected
5866efa8cbfbadf3905072798e96652faf02dbe8 to before a2c6f25ab98b423f99ccd94874d655b8bcb01a19Affected
5866efa8cbfbadf3905072798e96652faf02dbe8 to before 1c8bb965e9b0559ff0f5690615a527c30f651dd8Affected
5866efa8cbfbadf3905072798e96652faf02dbe8 to before d4b69a6186b215d2dc1ebcab965ed88e8d41768dAffected
66ed7b413d31c6ff23901ac4443b1cc1af2f6113Affected
7be8c165dc81564705e8e0b72d398ef708f67eaaAffected
4.19.99 to before 4.20Affected
5.4.15 to before 5.5Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.