CVE-2026-80924: crypto: krb5 - use kfree_sensitive() for derived key buffers
In the Linux kernel, the following vulnerability has been resolved:
crypto: krb5 - use kfreesensitive() for derived key buffers
cryptokrb5prepareencryption() and cryptokrb5preparechecksum() free the buffer holding the freshly derived keys with plain kfree(), leaving the key material behind in the freed slab object.
Event History
Frequently Asked Questions
What must an attacker be able to do to recover the affected key material?
The issue leaves freshly derived keys in a freed kernel slab object after the buffer is released. The provided information does not identify a specific attacker interface or prerequisite beyond the ability to access or disclose data from that freed memory.
What can be done if the fix cannot be deployed immediately?
No mitigation or configuration workaround is provided. The described fix is to free derived-key buffers with kfree_sensitive() so the key material is cleared before the memory is released.