CVE-2025-40129 sunrpc: fix null pointer dereference on zero-length checksum
A null pointer dereference in the Linux kernel's sunrpc module allows attackers to cause a denial of service via zero-length checksums.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40129?
CVE-2025-40129 is a high-severity vulnerability in Linux, published on 12 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: fix null pointer dereference on zero-length checksum
In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT.
Which versions are affected by CVE-2025-40129?
How do I fix CVE-2025-40129?
Apply the vendor's patch.
Is CVE-2025-40129 being exploited?
There is no known exploitation of CVE-2025-40129 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40129, DEBIAN-CVE-2025-40129, GHSA-c9g4-75m8-v388, ROOT-OS-DEBIAN-13-CVE-2025-40129, ROOT-OS-UBUNTU-2404-CVE-2025-40129, UBUNTU-CVE-2025-40129.