High 7.5Published Jan 14, 2026

CVE-2025-71120SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

Updated under an hour ago (Oct 27, 2026, 8:10 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 5866efa8cbfbadf3905072798e96652faf02dbe8 before a8f1e445ce3545c90d69c9e8ff8f7821825fe810; 5866efa8cbfbadf3905072798e96652faf02dbe8 builds before 4dedb6a11243a5c9eb9dbb97bca3c98bd725e83d; from 5866efa8cbfbadf3905072798e96652faf02dbe8 before f9e53f69ac3bc4ef568b08d3542edac02e83fefd; from 5866efa8cbfbadf3905072798e96652faf02dbe8 before 7452d53f293379e2c38cfa8ad0694aa46fc4788b; from 5866efa8cbfbadf3905072798e96652faf02dbe8 before a2c6f25ab98b423f99ccd94874d655b8bcb01a19; 5866efa8cbfbadf3905072798e96652faf02dbe8 builds before 1c8bb965e9b0559ff0f5690615a527c30f651dd8; from 5866efa8cbfbadf3905072798e96652faf02dbe8 before d4b69a6186b215d2dc1ebcab965ed88e8d41768d; 66ed7b413d31c6ff23901ac4443b1cc1af2f6113; and 3 more ranges	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.19.99 before 4.20; from 5.4.15 before 5.5; from 5.5.1 before 5.10.248; from 5.11 before 5.15.198; from 5.16 before 6.1.160; from 6.2 before 6.6.120; from 6.7 before 6.12.64; from 6.13 before 6.18.3; and 9 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a8f1e445ce3545c90d69c9e8ff8f7821825fe810	patch
https://git.kernel.org/stable/c/4dedb6a11243a5c9eb9dbb97bca3c98bd725e83d	patch
https://git.kernel.org/stable/c/f9e53f69ac3bc4ef568b08d3542edac02e83fefd	patch
https://git.kernel.org/stable/c/7452d53f293379e2c38cfa8ad0694aa46fc4788b	patch
https://git.kernel.org/stable/c/a2c6f25ab98b423f99ccd94874d655b8bcb01a19	patch
https://git.kernel.org/stable/c/1c8bb965e9b0559ff0f5690615a527c30f651dd8	patch
https://git.kernel.org/stable/c/d4b69a6186b215d2dc1ebcab965ed88e8d41768d	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.