In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

A zero length gss_token results in pages == 0 and in_token->pages[0]
is NULL. The code unconditionally evaluates
page_address(in_token->pages[0]) for the initial memcpy, which can
dereference NULL even when the copy length is 0. Guard the first
memcpy so it only runs when length > 0.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00053.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
5866efa8cbfbadf3905072798e96652faf02dbe8 affected
< a8f1e445ce3545c90d69c9e8ff8f7821825fe810
5866efa8cbfbadf3905072798e96652faf02dbe8 affected
< 4dedb6a11243a5c9eb9dbb97bca3c98bd725e83d
5866efa8cbfbadf3905072798e96652faf02dbe8 affected
< f9e53f69ac3bc4ef568b08d3542edac02e83fefd
5866efa8cbfbadf3905072798e96652faf02dbe8 affected
< 7452d53f293379e2c38cfa8ad0694aa46fc4788b
5866efa8cbfbadf3905072798e96652faf02dbe8 affected
< a2c6f25ab98b423f99ccd94874d655b8bcb01a19
5866efa8cbfbadf3905072798e96652faf02dbe8 affected
< 1c8bb965e9b0559ff0f5690615a527c30f651dd8
5866efa8cbfbadf3905072798e96652faf02dbe8 affected
< d4b69a6186b215d2dc1ebcab965ed88e8d41768d
66ed7b413d31c6ff23901ac4443b1cc1af2f6113 affected
—
7be8c165dc81564705e8e0b72d398ef708f67eaa affected
—
Linux Linux affected
Version Status Constraints
5.5 affected
—
0 unaffected
< 5.5
5.10.248 unaffected
≤ 5.10.*
5.15.198 unaffected
≤ 5.15.*
6.1.160 unaffected
≤ 6.1.*
6.6.120 unaffected
≤ 6.6.*
6.12.64 unaffected
≤ 6.12.*
6.18.3 unaffected
≤ 6.18.*
6.19 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4475-1 linux security update
Debian DLA Debian DLA DLA-4476-1 linux-6.1 security update
Debian DSA Debian DSA DSA-6126-1 linux security update
Debian DSA Debian DSA DSA-6127-1 linux security update
Ubuntu USN Ubuntu USN USN-8096-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-4 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-5 Linux kernel (NVIDIA Tegra IGX) vulnerabilities
Ubuntu USN Ubuntu USN USN-8116-1 Linux kernel (Intel IoTG Real-time) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1c8bb965e9b0559ff0f5690615a527c30f651dd8 cve-icon cve-icon
https://git.kernel.org/stable/c/4dedb6a11243a5c9eb9dbb97bca3c98bd725e83d cve-icon cve-icon
https://git.kernel.org/stable/c/7452d53f293379e2c38cfa8ad0694aa46fc4788b cve-icon cve-icon
https://git.kernel.org/stable/c/a2c6f25ab98b423f99ccd94874d655b8bcb01a19 cve-icon cve-icon
https://git.kernel.org/stable/c/a8f1e445ce3545c90d69c9e8ff8f7821825fe810 cve-icon cve-icon
https://git.kernel.org/stable/c/d4b69a6186b215d2dc1ebcab965ed88e8d41768d cve-icon cve-icon
https://git.kernel.org/stable/c/f9e53f69ac3bc4ef568b08d3542edac02e83fefd cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2026011415-CVE-2025-71120-d0a6@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-71120 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-71120 cve-icon
History

Wed, 25 Mar 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
CPEs cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Mon, 19 Jan 2026 12:45:00 +0000

Type Values Removed Values Added
References

Thu, 15 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 14 Jan 2026 15:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.
Title SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-02-09T08:35:15.157Z

Reserved: 2026-01-13T15:30:19.654Z

Link: CVE-2025-71120

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-01-14T15:16:01.690

Modified: 2026-03-25T18:45:33.077

Link: CVE-2025-71120

cve-icon Redhat

Severity : Important

Publid Date: 2026-01-14T00:00:00Z

Links: CVE-2025-71120 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses