CVE-2025-71120: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.

Affected products

• Linux Linux Kernel: from 4.19.99, before 4.20 (fixed in 4.20); from 5.4.15, before 5.5 (fixed in 5.5); from 5.5.1, before 5.10.248 (fixed in 5.10.248); from 5.11, before 5.15.198 (fixed in 5.15.198); from 5.16, before 6.1.160 (fixed in 6.1.160); from 6.2, before 6.6.120 (fixed in 6.6.120); …

Published 2026-01-14. Last modified 2026-07-30.