The Linux kernel's SUNRPC svcauth_gss_unwrap_priv() function validates only the upper bound of the wire-supplied opaque token length before passing it to gss_unwrap(). Tokens with length between 0 and 16 bytes bypass this check and reach the krb5 unwrap path, where gss_krb5_unwrap_v2() reads the 16-byte RFC 4121 token header. If the token is truncated or exactly 16 bytes, the rotate_left() function can perform a modulo operation with zero, causing a division by zero error. The vulnerability is mitigated by adding a minimum length check immediately after the upper bound check to reject tokens with length less than or equal to the 16-byte header length.

This vulnerability can cause a division by zero error in the kernel during processing of malformed Kerberos v5 tokens, potentially leading to a denial of service condition on affected systems. There is no information about code execution or privilege escalation. No known exploits are reported in the wild.

A fix is available that adds a minimum length check to the svcauth_gss_unwrap_priv() function to reject tokens that are too short before they reach the krb5 unwrap core. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, updating to a fixed kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.