CVE-2025-71120 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and take necessary actions to mitigate it. This includes inventorying Linux kernel installations, applying patches or updates provided by the Linux kernel maintainers, and monitoring system logs for potential exploitation attempts.

Technical summary

The vulnerability is caused by a NULL dereference on a zero-length gss_token in the gss_read_proxy_verf function. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. To fix this, a check should be added to ensure that the length is greater than 0 before performing the memcpy. The fix involves adding a simple length check.

Defensive priority

Medium

Recommended defensive actions

• Inventory Linux kernel installations to identify potential exposure.
• Apply patches or updates provided by the Linux kernel maintainers.
• Monitor system logs for potential exploitation attempts.
• Implement compensating controls, such as network segmentation or access controls, to limit the attack surface.
• Consider using a Web Application Firewall (WAF) to detect and prevent exploitation attempts.
• Review and update incident response plans to address potential exploitation.
• Conduct regular vulnerability assessments to identify and address potential exposures.

Evidence notes

The CVE record was published on 2026-01-14T15:16:01.690Z and was last modified on 2026-07-14T13:18:03.810Z. The NVD entry is currently Modified. The Linux kernel vulnerability affects SUNRPC component. Evidence is limited, and defenders should verify system logs for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.