Description
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0.
Metrics
CVSS 3.1 5.5/10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 5866efa8cbfbadf3905072798e96652faf02dbe8, < a8f1e445ce3545c90d69c9e8ff8f7821825fe810; >= 5866efa8cbfbadf3905072798e96652faf02dbe8, < 4dedb6a11243a5c9eb9dbb97bca3c98bd725e83d; >= 5866efa8cbfbadf3905072798e96652faf02dbe8, < f9e53f69ac3bc4ef568b08d3542edac02e83fefd; >= 5866efa8cbfbadf3905072798e96652faf02dbe8, < 7452d53f293379e2c38cfa8ad0694aa46fc4788b; >= 5866efa8cbfbadf3905072798e96652faf02dbe8, < a2c6f25ab98b423f99ccd94874d655b8bcb01a19; >= 5866efa8cbfbadf3905072798e96652faf02dbe8, < 1c8bb965e9b0559ff0f5690615a527c30f651dd8; >= 5866efa8cbfbadf3905072798e96652faf02dbe8, < d4b69a6186b215d2dc1ebcab965ed88e8d41768d; 66ed7b413d31c6ff23901ac4443b1cc1af2f6113; 7be8c165dc81564705e8e0b72d398ef708f67eaa; >= 4.19.99, < 4.20; >= 5.4.15, < 5.5 |
| Linux | Linux | 5.5 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | >= V3.1.6, < * |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | >= V3.1.7, < * |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | >= V3.1.6, < * |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | >= V3.1.7, < * |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | >= V3.1.6, < * |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | >= V3.1.7, < * |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | >= V3.1.6, < * |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | >= V3.1.7, < * |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | >= V3.1.6, < * |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | >= V3.1.7, < * |
References
- https://git.kernel.org/stable/c/1c8bb965e9b0559ff0f5690615a527c30f651dd8Patch
- https://git.kernel.org/stable/c/4dedb6a11243a5c9eb9dbb97bca3c98bd725e83dPatch
- https://git.kernel.org/stable/c/7452d53f293379e2c38cfa8ad0694aa46fc4788bPatch
- https://git.kernel.org/stable/c/a2c6f25ab98b423f99ccd94874d655b8bcb01a19Patch
- https://git.kernel.org/stable/c/a8f1e445ce3545c90d69c9e8ff8f7821825fe810Patch
- https://git.kernel.org/stable/c/d4b69a6186b215d2dc1ebcab965ed88e8d41768dPatch
- https://git.kernel.org/stable/c/f9e53f69ac3bc4ef568b08d3542edac02e83fefdPatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
Timeline
- Published
- Jan 14, 2026
- Last modified
- Nov 10, 2026
- NVD status
- Modified