CVE-2025-40129: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's sunrpc subsystem was discovered and resolved on November 12, 2025. The vulnerability (CVE-2025-40129) involves a null pointer dereference that occurs when processing zero-length checksums in the xdrstreamdecodeopaqueauth() function (NVD, Ubuntu).

The vulnerability occurs when xdrstreamdecodeopaqueauth() processes a zero-length checksum.len value, which causes checksum.data to be set to NULL. This subsequently triggers a null pointer dereference when accessing checksum.data in the gsskrb5verifymicv2() function. The fix ensures that the value of checksum.len is not less than XDR_UNIT (NVD).

The vulnerability affects multiple versions of the Linux kernel, particularly impacting newer releases. Several Ubuntu distributions including 25.10 (questing), 24.04 LTS (noble), and various kernel variants are marked as vulnerable. Older versions like 22.04 LTS (jammy), 20.04 LTS (focal), and 18.04 LTS (bionic) are not affected (Ubuntu).

The vulnerability has been patched in the Linux kernel. System administrators should apply the available kernel updates for affected systems. Multiple kernel variants including linux-azure, linux-gcp, and linux-aws have patches available for affected versions (Ubuntu).