CVE-2026-116497
Description
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.
Statement
Red Hat has confirmed this vulnerability in gssproxy as shipped in Red Hat Enterprise Linux. The gssproxy daemon crashes when it receives a GSSX_INIT_SEC_CONTEXT request with the target_name field absent, due to a missing NULL pointer check. This can be triggered by any local user without authentication, causing a denial of service that persists until the daemon is manually restarted. Services that depend on gssproxy for Kerberos credential management, including NFS and IdM, are affected while the daemon is down.
Mitigation
There is no way to fully mitigate this vulnerability without applying a code fix. The gssproxy Unix socket must be world-accessible for normal operation, and the default configuration accepts connections from any local user.
As a partial workaround, administrators can add "Restart=on-failure" to the gssproxy systemd unit to enable automatic restarts after a crash. This does not prevent the crash but limits the denial-of-service window. Note that a persistent attacker can still outpace the restart cycle.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 5.5 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat CVSS v3 Score Explanation
Conservative scoring with Scope:Unchanged. S:C (6.5) is defensible given cascading impact on NFS/IdM/httpd, but S:U chosen as the safe baseline.
Acknowledgements
Red Hat would like to thank Andrey Vasilevsky for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
