SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

Summary

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.

Timeline

1. Jan 14, 2026, 3:06 PM UTCCVE published
2. Jun 10, 2026, 8:42 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 19, 2026, 6:15 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 5866efa8cbfbadf3905072798e96652faf02dbe8 · fixed in a8f1e445ce3545c90d69c9e8ff8f7821825fe810; From 5866efa8cbfbadf3905072798e96652faf02dbe8 · fixed in 4dedb6a11243a5c9eb9dbb97bca3c98bd725e83d; From 5866efa8cbfbadf3905072798e96652faf02dbe8 · fixed in f9e53f69ac3bc4ef568b08d3542edac02e83fefd; From 5866efa8cbfbadf3905072798e96652faf02dbe8 · fixed in 7452d53f293379e2c38cfa8ad0694aa46fc4788b; From 5866efa8cbfbadf3905072798e96652faf02dbe8 · fixed in a2c6f25ab98b423f99ccd94874d655b8bcb01a19; From 5866efa8cbfbadf3905072798e96652faf02dbe8 · fixed in 1c8bb965e9b0559ff0f5690615a527c30f651dd8; From 5866efa8cbfbadf3905072798e96652faf02dbe8 · fixed in d4b69a6186b215d2dc1ebcab965ed88e8d41768d; From 4.19.99 · fixed in 4.20; From 5.4.15 · fixed in 5.5

• Linux Linux

  5.5

• KernelLinux

  From 5.5.0 · fixed in 5.10.248; From 5.11.0 · fixed in 5.15.198; From 5.16.0 · fixed in 6.1.160; From 6.2.0 · fixed in 6.6.120; From 6.7.0 · fixed in 6.12.64; From 6.13.0 · fixed in 6.18.3

References 7