CVE-2025-71120: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71120 is a NULL pointer dereference vulnerability in the Linux kernel's SUNRPC svcauth_gss module, specifically in the gss_read_proxy_verf function. When a zero-length gss_token is processed, the code unconditionally attempts to dereference in_token->pages[0] — which is NULL — during a memcpy operation, even when the copy length is zero. The vulnerability was published on January 14, 2026, and affects numerous Linux kernel versions across multiple stable branches, as well as Microsoft's Azure Linux (azl3_kernel_6.6.119.3-3). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In the gss_read_proxy_verf function within net/sunrpc/auth_gss/svcauth_gss.c, when a GSS token of zero length is received, no pages are allocated (pages == 0), leaving in_token->pages[0] as NULL. The code then calls page_address(in_token->pages[0]) unconditionally as the source for the initial memcpy, triggering a NULL dereference even when the copy length is zero. The fix guards the first memcpy with a length > 0 check. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local low-privilege user who can send a crafted SUNRPC GSS authentication request to the kernel (Feedly, kernel.org patch).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a complete denial of service (DoS) of the affected host. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems running NFS servers or other services relying on SUNRPC GSS-API proxy authentication are particularly at risk, as a crash would disrupt all services on the affected host (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

• Logs: Unexpected kernel panic messages in /var/log/kern.log or dmesg output referencing a NULL pointer dereference in gss_read_proxy_verf or svcauth_gss.
• Logs: System crash/reboot events correlated with SUNRPC or NFS GSS authentication activity.
• Process/System: Sudden system unavailability or unplanned reboots on hosts running NFS servers with Kerberos/GSS authentication enabled.
• Network: Unusual or malformed SUNRPC GSS authentication requests (zero-length GSS tokens) arriving at the server from local or network clients.

Patches are available across multiple stable Linux kernel branches. Upgrade to one of the following fixed versions depending on your current branch: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, or 6.18.3. Microsoft has also released updates for affected Azure Linux (azl3_kernel) systems. As a temporary workaround where patching is not immediately possible, restrict local system access and consider disabling SUNRPC GSS proxy authentication if not required. Monitor for unexpected kernel panics related to SUNRPC authentication (Feedly, Microsoft MSRC).