RLSA-2026:99624: Important: krb5 security, bug fix, and enhancement update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

krb5: MIT krb5 kadmind unauthenticated memory exhaustion via failed AUTHGSSAPIINIT requests (CVE-2026-112323)

krb5: MIT krb5 kadmind unauthenticated CPU DoS via AUTHGSSAPI client states cleanup (CVE-2026-112322)

krb5: MIT krb5 GSS-RPC client memory leak on XID mismatch retries (CVE-2026-112314)

krb5: Unauthenticated KDC NULL pointer dereference KDC DoS via crafted PKINIT pre-auth request (CVE-2026-71200)

krb5: MIT krb5 kadmind unauthenticated memory leak DoS via AUTHGSSAPIINIT error paths (CVE-2026-112321)

krb5: MIT krb5 kadmind unauthenticated memory leak DoS via GSS-RPC auth flavor switching (CVE-2026-112320)

krb5: Unauthorized key reset of protected principal via kpasswd (CVE-2026-107884)

krb5: MIT krb5 kadmind authenticated memory exhaustion DoS via unbounded RPC XDR allocation (CVE-2026-112319)

krb5: MIT krb5 kadmind authenticated DoS exploiting dereference of null policy name pointers (CVE-2026-112318)

krb5: MIT krb5 KDC unauthenticated memory leak DoS in KDB keytab key decryption error path (CVE-2026-112317)

krb5: MIT krb5 KDC unauthenticated CPU DoS via quadratic ASN.1 SEQUENCE OF decoding (CVE-2026-119079)

krb5: MIT krb5 kadmind authenticated memory leak DoS in xdrkrb5tldata() decode failure (CVE-2026-112316)

krb5: Improper authorization via flawed PAC checksum verification (CVE-2026-111423)

krb5: MIT krb5 kadmind unauthenticated memory leak DoS in RPCSECGSS buffer decode failure (CVE-2026-112315)

krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests (CVE-2026-107708)

krb5: krb5: Denial of Service via crafted forwarded credentials (CVE-2026-107778)

krb5: Alteration of authentication indicators in CAMMAC container (CVE-2026-71199)

krb5: kadmind: request alteration and protected information disclosure (CVE-2026-118380)

krb5: Unauthenticated KDC DoS based on ASN.1 decoder read overrun (CVE-2026-107364)

Bug Fix(es) and Enhancement(s):

Set PKINIT CMS signatureAlgorithm based on certificate public key type [rhel-10.3.z] (JIRA:Rocky Linux-278063)

authgssapiwrapdata xdrbytes failure leak [rhel-10.3.z] (JIRA:Rocky Linux-296012)

xdrbytes() does not free its allocation on partial decode failure [rhel-10.3.z] (JIRA:Rocky Linux-296023)

RPCSECGSS context lifecycle leaks [rhel-10.3.z] (JIRA:Rocky Linux-296034)

xdrkrb5principal decode leak [rhel-10.3.z] (JIRA:Rocky Linux-296045)

processchpwrequest leak [rhel-10.3.z] (JIRA:Rocky Linux-296056)

Read overruns in GSSRPC svcauthunix [rhel-10.3.z] (JIRA:Rocky Linux-296067)

Null dereference in KDC dispatch corner case [rhel-10.3.z] (JIRA:Rocky Linux-296081)

KDC DoS based on otherName value in PKINIT SAN code [rhel-10.3.z] (JIRA:Rocky Linux-296095)

Memory leak on krb5 gssacceptseccontext() failure [rhel-10.3.z] (JIRA:Rocky Linux-296112)

KDC authdata filter does not catch KDC-issued types nested inside AD-IF-RELEVANT containers [rhel-10.3.z] (JIRA:Rocky Linux-296127)

Dereference of empty first credential list element in GSS mechanism [rhel-10.3.z] (JIRA:Rocky Linux-296997)

Null dereference of principal names in krb5rdcred() [rhel-10.3.z] (JIRA:Rocky Linux-297000)

Fix validation issues for trusted inputs [rhel-10.3.z] (JIRA:Rocky Linux-299144)

Skip expired keys when iterating over KEYRING ccache [rhel-10.3.z] (JIRA:Rocky Linux-299145)

Pass through null delegcred from SPNEGO to mech [rhel-10.3.z] (JIRA:Rocky Linux-299146)

Fix leaks on error in PKINIT signed-data creation [rhel-10.3.z] (JIRA:Rocky Linux-299147)

Fix hex key input handling in ktutil addent [rhel-10.3.z] (JIRA:Rocky Linux-299148)

Check reply length before V4 reply check [rhel-10.3.z] (JIRA:Rocky Linux-299149)

Fix memory leak in mpoolget() error paths [rhel-10.3.z] (JIRA:Rocky Linux-299150)

json: Correctly abort parse on invalid array [rhel-10.3.z] (JIRA:Rocky Linux-299151)

Prevent unsigned int overflow in iakerbsavetoken() [rhel-10.3.z] (JIRA:Rocky Linux-299152)

Fix ksu memory leak in fcmdresolve() [rhel-10.3.z] (JIRA:Rocky Linux-299153)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.