CVE-2026-64439: crypto: krb5 - filter out async aead implementations at alloc
In the Linux kernel, the following vulnerability has been resolved:
crypto: krb5 - filter out async aead implementations at alloc
krb5aeadencrypt(), krb5aeaddecrypt() in rfc3961simplified.c and rfc8009encrypt(), rfc8009decrypt() in rfc8009aes2.c set a NULL completion callback and treat any negative return from cryptoaead{encrypt,decrypt}() as terminal, falling through to kfreesensitive(buffer). When the encryptname resolves to an async AEAD instance the request returns -EINPROGRESS, the buffer is freed while the backend's worker still holds a pointer, and the worker dereferences the freed slab on completion.
KASAN report under UML+SLUB with a synthetic async aead backend bound to krb5->encryptname:
BUG: KASAN: slab-use-after-free in t5stubcomplete+0x7d/0xc7
The helpers were written synchronously, so filter the async instances out at allocation time instead of plumbing cryptowaitreq() through every call site.
Reachable via net/rxrpc/rxgk.c, fs/afs/cmsecurity.c and net/ceph/crypto.c on systems with an async AEAD provider bound to the krb5 enctype name.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64439?
CVE-2026-64439 has a critical severity rating of 9.8, indicating a high risk to affected systems.
How do I fix CVE-2026-64439?
To fix CVE-2026-64439, you should update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-64439?
CVE-2026-64439 affects the Linux kernel, particularly implementations using krb5 asynchronous authenticated encryption.
What type of vulnerability is CVE-2026-64439 classified as?
CVE-2026-64439 is classified as a Use After Free vulnerability.
What code components are involved in CVE-2026-64439?
CVE-2026-64439 involves the krb5_aead_encrypt() and krb5_aead_decrypt() functions in the Linux kernel.