PT-2026-64660 · Linux · Linux
CVE-2026-64439
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
crypto: krb5 - filter out async aead implementations at alloc
krb5 aead encrypt(), krb5 aead decrypt() in rfc3961 simplified.c and
rfc8009 encrypt(), rfc8009 decrypt() in rfc8009 aes2.c set a NULL
completion callback and treat any negative return from
crypto aead {encrypt,decrypt}() as terminal, falling through to
kfree sensitive(buffer). When the encrypt name resolves to an
async AEAD instance the request returns -EINPROGRESS, the buffer
is freed while the backend's worker still holds a pointer, and the
worker dereferences the freed slab on completion.
KASAN report under UML+SLUB with a synthetic async aead backend
bound to krb5->encrypt name:
BUG: KASAN: slab-use-after-free in t5 stub complete+0x7d/0xc7
The helpers were written synchronously, so filter the async
instances out at allocation time instead of plumbing
crypto wait req() through every call site.
Reachable via net/rxrpc/rxgk.c, fs/afs/cm security.c and
net/ceph/crypto.c on systems with an async AEAD provider bound to
the krb5 enctype name.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux