CVE-2026-116497: Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSXINITSECCONTEXT request is received with the targetname field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.
Other sources
A NULL pointer dereference vulnerability was found in gssproxy's handling of GSSXINITSECCONTEXT requests. When a client sends this request with the optional targetname field marked absent, the daemon dereferences the resulting NULL pointer and crashes with SIGSEGV.
The request requires no authentication — any local user can send it via the gssproxy Unix socket, which is created with mode 0666 (world-accessible). The default shipped configuration (99-network-fs-clients.conf) uses allowanyuid=yes, meaning connections from any local uid are matched to a service and processed.
The gssproxy systemd unit has no Restart= directive, so once crashed the daemon stays down until manually restarted. All dependent services — including rpc-gssd (NFS Kerberos), nfsd, httpd via modauthgssapi, and IdM/FreeIPA — lose credential operations.
The defect is a missing NULL check at one call site in the initseccontext handler before passing targetname to a conversion function. Three other call sites in the codebase guard this same pointer before use, indicating the omission is an oversight.
Reported via PSIRTSUPT-26284 with a complete proof of concept and a two-line fix. Reproduced on gssproxy-0.9.2-10.el10 (RHEL 10.2) from an unprivileged local account.
— Red Hat