CVE-2026-64439

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: krb5 - filter out async aead implementations at alloc

krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and

rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL

completion callback and treat any negative return from

crypto_aead_{encrypt,decrypt}() as terminal, falling through to

kfree_sensitive(buffer). When the encrypt_name resolves to an

async AEAD instance the request returns -EINPROGRESS, the buffer

is freed while the backend's worker still holds a pointer, and the

worker dereferences the freed slab on completion.

KASAN report under UML+SLUB with a synthetic async aead backend

bound to krb5->encrypt_name:

BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7

The helpers were written synchronously, so filter the async

instances out at allocation time instead of plumbing

crypto_wait_req() through every call site.

Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References