CVE-2026-64439
Received Received - Intake

Heap-based Use-After-Free in Linux Kernel KRB5 Crypto

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion callback and treat any negative return from crypto_aead_{encrypt,decrypt}() as terminal, falling through to kfree_sensitive(buffer). When the encrypt_name resolves to an async AEAD instance the request returns -EINPROGRESS, the buffer is freed while the backend's worker still holds a pointer, and the worker dereferences the freed slab on completion. KASAN report under UML+SLUB with a synthetic async aead backend bound to krb5->encrypt_name: BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7 The helpers were written synchronously, so filter the async instances out at allocation time instead of plumbing crypto_wait_req() through every call site. Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and net/ceph/crypto.c on systems with an async AEAD provider bound to the krb5 enctype name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64439
EUVD
EUVD-2026-48783

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mitre krb5 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of asynchronous encryption operations in the krb5 cryptographic module. Functions like krb5_aead_encrypt and krb5_aead_decrypt incorrectly process negative return values from crypto_aead_encrypt and crypto_aead_decrypt, treating them as terminal errors. This leads to a use-after-free condition when async AEAD instances are involved, as the buffer is freed while the backend's worker still holds a reference.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem and requires an async AEAD provider bound to krb5 encryption. Detection involves checking kernel logs for slab-use-after-free errors or monitoring for crashes in crypto operations. Commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-use-after-free may help identify issues.

Impact Analysis

This vulnerability can cause system crashes or instability due to slab-use-after-free errors. It may also lead to potential privilege escalation or unauthorized access if exploited by an attacker with local system access. Systems using async AEAD providers with krb5 encryption are particularly affected.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using a custom kernel, ensure async AEAD providers are not bound to krb5 encryption names. Monitor kernel logs for related errors and update affected services like rxrpc, afs, or ceph if they rely on krb5 encryption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart