CVE-2026-116497
Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in gssproxy Leads to DoS

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: redhat-SADP

Description
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116497
EUVD
EUVD-2026-109941

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is sent without the target_name field, the daemon crashes due to dereferencing a NULL pointer. This causes a SIGSEGV error and requires no authentication, allowing any local user to exploit it via the gssproxy Unix socket.

Detection Guidance
  • Check if gssproxy is running: systemctl status gssproxy
  • Verify gssproxy socket permissions: ls -l /run/gssproxy.sock
  • Test for crashes in gssproxy logs: journalctl -u gssproxy --no-pager | grep -i segv
  • Attempt to trigger the vulnerability locally and observe daemon crash
Impact Analysis

The vulnerability allows any local user to crash the gssproxy daemon, causing a persistent denial of service. Dependent services like Kerberized NFS, IdM, and others relying on gssproxy lose credential operations until the daemon is manually restarted.

Mitigation Strategies
  • Apply the official patch from Red Hat if available for your system version
  • Restrict access to the gssproxy Unix socket by changing permissions: chmod 600 /run/gssproxy.sock
  • Enable automatic restarts for gssproxy via systemd: systemctl edit gssproxy and add Restart=on-failure
  • Monitor gssproxy service status and dependent services like NFS and IdM

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart