Answer in brief
CVE-2025-40129 records a Unknown severity vulnerability in sunrpc: fix null pointer dereference on zero-length checksum. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0653028e8f1c97fec30710813a001ad8a2ec34f4 <81cec07d303186d0d8c623ef8b5ecd3b81e94cf6 || >=0653028e8f1c97fec30710813a001ad8a2ec34f4 <affc03d44921f493deaae1d33151e3067a6f9f8f || >=0653028e8f1c97fec30710813a001ad8a2ec34f4 <ab9a70cd2386a0d70c164b0905dd66bc9af52e77 || >=0653028e8f1c97fec30710813a001ad8a2ec34f4 <6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 | 81cec07d303186d0d8c623ef8b5ecd3b81e94cf6, affc03d44921f493deaae1d33151e3067a6f9f8f, ab9a70cd2386a0d70c164b0905dd66bc9af52e77, 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 |
| Linux/Linuxgeneric | 6.3 | Not reported |
Published upstream
Nov 12, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-40129 records a Unknown severity vulnerability in sunrpc: fix null pointer dereference on zero-length checksum. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0653028e8f1c97fec30710813a001ad8a2ec34f4 <81cec07d303186d0d8c623ef8b5ecd3b81e94cf6 || >=0653028e8f1c97fec30710813a001ad8a2ec34f4 <affc03d44921f493deaae1d33151e3067a6f9f8f || >=0653028e8f1c97fec30710813a001ad8a2ec34f4 <ab9a70cd2386a0d70c164b0905dd66bc9af52e77 || >=0653028e8f1c97fec30710813a001ad8a2ec34f4 <6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 | 81cec07d303186d0d8c623ef8b5ecd3b81e94cf6, affc03d44921f493deaae1d33151e3067a6f9f8f, ab9a70cd2386a0d70c164b0905dd66bc9af52e77, 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 |
| Linux/Linuxgeneric | 6.3 | Not reported |
Published upstream
Nov 12, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT.
Quoted source text, attributed separately from HOL analysis.