A NULL pointer dereference vulnerability (CVE-2025-6395) exists in the GnuTLS library's _gnutls_figure_common_ciphersuite() function, which is part of the cryptographic implementation for SSL, TLS, and DTLS protocols. This vulnerability can cause an application crash, resulting in a denial of service. The issue affects Red Hat Enterprise Linux 9 and 10 across multiple architectures. Red Hat has rated the security impact as Moderate and assigned a CVSS score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H). Security advisories RHSA-2025:16115 and RHSA-2025:16116 provide updated gnutls packages that address this and related vulnerabilities. The vendor advisory confirms the availability of patches and provides instructions for applying them.

The vulnerability can cause a denial of service by crashing applications using the vulnerable GnuTLS library due to a NULL pointer dereference. There is no confidentiality impact, but integrity impact is rated low, and availability impact is high according to the CVSS vector. No known active exploits have been reported.

Red Hat has released updated gnutls packages for Red Hat Enterprise Linux 9 and 10 that fix this vulnerability. Users should apply these official security updates as detailed in Red Hat advisories RHSA-2025:16115 and RHSA-2025:16116. Patch availability is confirmed by the vendor advisory. No additional mitigation steps are required beyond applying the official fixes.