The vulnerability occurs in the Linux kernel’s SUNRPC implementation, where the function gss_krb5_verify_mic_v2() reads fields from a Kerberos MIC token without first verifying the token’s length. An attacker can send an NFS request containing a short, malformed token that satisfies only minimal bounds checks performed by higher‑level handlers. The kernel then reads past the allocated buffer, creating an out‑of‑) that could leak kernel memory contents or provide information useful for a further exploit. The bug does not immediately grant code execution but enables information disclosure and may assist in chaining with other weaknesses.

This issue affects all Linux kernel releases that predated the commit adding a length guard to gss_krb5_verify_mic_v2(). The publicly available data does not provide exact version numbers, so any kernel running prior to the patch referenced by the commit literature is considered vulnerable.

The CVSS score of 6.4 categorizes the problem as moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. However, the attack surface is network‑based through NFS servers; a compromised or untrusted NFS server could target affected clients. Given the nature of the fault, the risk is significant for environments exposed to potential malicious NFS traffic, especially those using GSS‑enabled mounts.