Null Pointer Dereference Vulnerability in Linux Kernel

CVE-2025-40129

What is CVE-2025-40129?

A vulnerability in the Linux kernel was identified wherein a null pointer dereference could occur due to a zero-length checksum in the xdr_stream_decode_opaque_auth() function. When the checksum.len is zero, it sets checksum.data to NULL, leading to a potential null pointer dereference in the gss_krb5_verify_mic_v2() function. A patch has been issued to ensure that checksum.len is never less than XDR_UNIT, thereby mitigating this risk.

References