CVE-2025-32912

What it actually does

NULL pointer dereference in SoupAuthDigest digest authentication handling allows a remote HTTP server to trigger a crash in the libsoup client.

Why it matters to the business

Attackers can remotely crash client applications that use libsoup for HTTP requests, causing denial of service and interrupting dependent services or workflows; the large number of affected Red Hat realtime kernel packages increases exposure across enterprise Linux environments.

How an attack unfolds

An attacker hosts a malicious HTTP server that returns crafted responses during digest authentication; when a vulnerable libsoup client connects and processes the response, the NULL dereference occurs and the client process terminates.

How to fix it

Upgrade all affected kernel-rt packages to the fixed versions: kernel-rt, kernel-rt-core, kernel-rt-debug and related packages to 0:5.14.0-284.97.1.rt14.382.el9_2 (or later) for both nfv and realtime variants on rhel_eus 9.2.

How to confirm the fix worked

Verify package versions match or exceed the listed fixed releases using rpm -q or dnf; confirm absence of the vulnerable libsoup code paths handling NULL digest structures via source inspection or updated library manifests.

Typical attack path

1. Attacker deploys HTTP server returning malicious digest auth responses
2. Victim client using libsoup initiates connection to attacker-controlled server
3. Server response triggers NULL pointer dereference in SoupAuthDigest
4. Client application crashes, resulting in denial of service

How to detect it

Review application and system logs for abrupt client process terminations immediately after outbound HTTP requests; correlate crash signatures with libsoup digest authentication handling.

What your security team should do

• Prioritize patching all listed kernel-rt packages within the CISA remediation window if applicable
• Monitor EPSS trend and reassess if exploit maturity increases
• Restrict outbound HTTP connections from libsoup clients to untrusted servers where feasible