CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: svcauthgss: avoid NULL deref on zero length gsstoken in gssreadproxyverf
A zero length gsstoken results in pages == 0 and intoken->pages[0] is NULL. The code unconditionally evaluates pageaddress(intoken->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Guard the initial memcpy in gss_read_proxy_verf so it only runs when the copy length is greater than 0, preventing dereferencing in_token->pages[0] when a zero-length gss_token results in pages == 0.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71120?
CVE-2025-71120 has been classified with a high severity due to potential denial-of-service outcomes.
What systems are affected by CVE-2025-71120?
CVE-2025-71120 affects various versions of the Linux kernel that utilize the SUNRPC protocol.
How do I fix CVE-2025-71120?
To fix CVE-2025-71120, update your Linux kernel to the latest version where the vulnerability has been patched.
What kind of vulnerability is CVE-2025-71120?
CVE-2025-71120 is a vulnerability that allows for NULL dereference through a zero-length gss_token in GSS authentication.
What impact does CVE-2025-71120 have on systems?
CVE-2025-71120 can lead to system crashes or service interruptions due to its denial-of-service nature.