Upstream information

CVE-2025-40129 at MITRE

Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: fix null pointer dereference on zero-length checksum

In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes
checksum.data to be set to NULL. This triggers a NPD when accessing
checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that
the value of checksum.len is not less than XDR_UNIT.

SUSE information

Overall state of this security issue: Does not affect SUSE products

SUSE Bugzilla entry: 1253472 [NEW]

No SUSE Security Announcements cross referenced.

SUSE Timeline for this CVE

CVE page created: Thu Nov 13 21:26:00 2025
CVE page last modified: Thu Nov 13 21:26:00 2025