CVE-2026-64439

Analyzed Analyzed - Analysis Complete

Heap-based Use-After-Free in Linux Kernel KRB5 Crypto

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion callback and treat any negative return from crypto_aead_{encrypt,decrypt}() as terminal, falling through to kfree_sensitive(buffer). When the encrypt_name resolves to an async AEAD instance the request returns -EINPROGRESS, the buffer is freed while the backend's worker still holds a pointer, and the worker dereferences the freed slab on completion. KASAN report under UML+SLUB with a synthetic async aead backend bound to krb5->encrypt_name: BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7 The helpers were written synchronously, so filter the async instances out at allocation time instead of plumbing crypto_wait_req() through every call site. Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and net/ceph/crypto.c on systems with an async AEAD provider bound to the krb5 enctype name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64439

EUVD

EUVD-2026-48783

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.15 (inc) to 6.18.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of asynchronous encryption operations in the krb5 cryptographic module. Functions like krb5_aead_encrypt and krb5_aead_decrypt incorrectly process negative return values from crypto_aead_encrypt and crypto_aead_decrypt, treating them as terminal errors. This leads to a use-after-free condition when async AEAD instances are involved, as the buffer is freed while the backend's worker still holds a reference.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem and requires an async AEAD provider bound to krb5 encryption. Detection involves checking kernel logs for slab-use-after-free errors or monitoring for crashes in crypto operations. Commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-use-after-free may help identify issues.

Impact Analysis

This vulnerability can cause system crashes or instability due to slab-use-after-free errors. It may also lead to potential privilege escalation or unauthorized access if exploited by an attacker with local system access. Systems using async AEAD providers with krb5 encryption are particularly affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a kernel-level memory corruption issue in the Linux crypto subsystem. Compliance impacts would depend on whether affected systems process regulated data, but the vulnerability itself is not a compliance violation.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using a custom kernel, ensure async AEAD providers are not bound to krb5 encryption names. Monitor kernel logs for related errors and update affected services like rxrpc, afs, or ceph if they rely on krb5 encryption.

Hi! I’m here to help you understand CVE-2026-64439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70