PT-2026-64660 · Linux · Linux
CVE-2026-64439
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
crypto: krb5 - filter out async aead implementations at alloc
krb5 aead encrypt(), krb5 aead decrypt() in rfc3961 simplified.c and
rfc8009 encrypt(), rfc8009 decrypt() in rfc8009 aes2.c set a NULL
completion callback and treat any negative return from
crypto aead {encrypt,decrypt}() as terminal, falling through to
kfree sensitive(buffer). When the encrypt name resolves to an
async AEAD instance the request returns -EINPROGRESS, the buffer
is freed while the backend's worker still holds a pointer, and the
worker dereferences the freed slab on completion.
KASAN report under UML+SLUB with a synthetic async aead backend
bound to krb5->encrypt name:
BUG: KASAN: slab-use-after-free in t5 stub complete+0x7d/0xc7
The helpers were written synchronously, so filter the async
instances out at allocation time instead of plumbing
crypto wait req() through every call site.
Reachable via net/rxrpc/rxgk.c, fs/afs/cm security.c and
net/ceph/crypto.c on systems with an async AEAD provider bound to
the krb5 enctype name.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux