LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-71120 is a Linux kernel SUNRPC GSS handling flaw. A specially malformed zero-length GSS token can reach code that dereferences a NULL page pointer. The public bundle shows stable kernel fixes, but no CVSS score, no confirmed exploitation, and no complete vendor exposure list.

Executive priority

Treat this as a monitored kernel maintenance item until vendor exposure is confirmed. Prioritize patch validation on systems using SUNRPC GSS functionality, but avoid emergency escalation unless a vendor rates it high or exploitation evidence appears.

Technical view

The issue is in svcauth_gss, specifically gss_read_proxy_verf. When gss_token length is zero, pages is zero and in_token->pages[0] is NULL. The vulnerable code evaluated page_address(in_token->pages[0]) before a zero-length memcpy. The fix guards the first memcpy so it only runs when length is greater than zero.

Likely exposure

Exposure appears limited to Linux kernels containing the vulnerable SUNRPC GSS code path. The bundle does not identify affected distributions, appliances, kernel configurations, or network-facing roles beyond Linux kernel versions and stable commits.

Exploitation context

The source bundle does not show CISA KEV listing, public exploitation, exploit availability, or weaponized details. The described primitive is a NULL dereference condition, so availability impact is the main concern, but real-world reachability is not established here.

Researcher notes

The vulnerability statement is precise, but impact and reachability evidence is thin. Key open questions are trigger preconditions, authentication context, kernel configuration dependence, distribution backports, and whether downstream products expose the vulnerable path.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Check distribution advisories for backported fixes before relying on version numbers alone.
  • Prioritize systems using SUNRPC GSS-related functionality.
  • Track Siemens advisory SSA-019113 for affected Siemens product guidance.
  • Monitor CVE and vendor records for severity and exploitation updates.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded systems.
  • Confirm whether kernels include one of the referenced fixing commits or a backport.
  • Review vendor advisories for affected package names and fixed releases.
  • Identify systems with SUNRPC GSS functionality enabled or in use.
  • Document exceptions where vendor guidance states the system is unaffected.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71120 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5866efa8cbfbadf3905072798e96652faf02dbe8, 5866efa8cbfbadf3905072798e96652faf02dbe8, 5866efa8cbfbadf3905072798e96652faf02dbe8, 5866efa8cbfbadf3905072798e96652faf02dbe8, 5866efa8cbfbadf3905072798e96652faf02dbe8, 5866efa8cbfbadf3905072798e96652faf02dbe8, 5866efa8cbfbadf3905072798e96652faf02dbe8, 66ed7b413d31c6ff23901ac4443b1cc1af2f6113, 7be8c165dc81564705e8e0b72d398ef708f67eaa, 4.19.99, 5.4.15unaffected
LinuxLinux5.5, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.