CVE-2025-71120

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-71120
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-71120.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-71120
Downstream
Related
Published
2026-01-14T15:06:07.194Z
Modified
2026-04-10T09:59:12.233691337Z
Summary
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
Details

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: svcauthgss: avoid NULL deref on zero length gsstoken in gssreadproxy_verf

A zero length gsstoken results in pages == 0 and intoken->pages[0] is NULL. The code unconditionally evaluates pageaddress(intoken->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71120.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5866efa8cbfbadf3905072798e96652faf02dbe8
Fixed
a8f1e445ce3545c90d69c9e8ff8f7821825fe810
Fixed
4dedb6a11243a5c9eb9dbb97bca3c98bd725e83d
Fixed
f9e53f69ac3bc4ef568b08d3542edac02e83fefd
Fixed
7452d53f293379e2c38cfa8ad0694aa46fc4788b
Fixed
a2c6f25ab98b423f99ccd94874d655b8bcb01a19
Fixed
1c8bb965e9b0559ff0f5690615a527c30f651dd8
Fixed
d4b69a6186b215d2dc1ebcab965ed88e8d41768d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
66ed7b413d31c6ff23901ac4443b1cc1af2f6113
Last affected
7be8c165dc81564705e8e0b72d398ef708f67eaa

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-71120.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.248
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.198
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.160
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.120
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.64
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-71120.json"