CVE-2025-71120

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the SUNRPC component, specifically in the svcauth gss function related to handling zero-length gss token values during the gss read proxy verf process. A zero-length token can lead to a NULL dereference when attempting to access memory associated with the token, potentially causing a system crash or other undefined behavior. The issue occurs because the code unconditionally attempts to evaluate page address(in token->pages[0]) even when the token is empty, leading to a potential NULL pointer dereference. The fix involves adding a guard to the initial memcpy operation to ensure it only executes when the length of the token is greater than zero.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.