In the Linux kernel, the svcauth_gss path checks only an upper bound on the length of a wire‑supplied opaque token before passing the buffer to the GSS/Kerberos unwrap routine. Because the minimum length check was missing, a token whose length is as short as the 16‑byte RFC 4121 header could still be processed, causing the GSS unwrap logic to build a zero‑length subbuffer and divide by zero in a rotation helper. The resulting divide‑by‑zero can trigger a kernel panic, disrupting system availability. This weakness is identified as CWE‑369 and can be mitigated by rejecting the token at the server entry point before it reaches the krb5 unwrap core. The mitigation commits are available in the kernel source as of commit 2eed1e6a and subsequent releases that contain it.

The flaw resides in the Linux Kernel's SUNRPC svcauth_gss implementation. All Linux kernel versions prior to the commit that adds the minimum token length check (including, but not limited to, those built before commit 2eed1e6a) are vulnerable. This affects any distribution that uses the default Ubuntu, Debian, Red Hat Enterprise Linux, Fedora, CentOS, and other kernels that include the unpatched svcauth_gss function. Specific affected versions are not listed in, any kernel before the fix is potentially vulnerable.

The CVSS score of 5.9 classifies this flaw as a medium‑severity vulnerability. Exploitation is likely to be remote, requiring a client to send a malformed SUNRPC Kerberos token to a vulnerable Linux server; the EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog. Attackers with the ability to communicate with the affected RPC service could trigger a denial of service by sending a specially crafted short token, but no known remote code execution or privilege escalation path is documented.