CVE-2026-64439

{"id": "CVE-2026-64439", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "00244da40f7821b242c4612428d4192230dba27f", "lessThan": "ef6feb77e2d91761427c5b773edc9c97e1b706ad", "versionType": "git"}, {"status": "affected", "version": "00244da40f7821b242c4612428d4192230dba27f", "lessThan": "2b7bd6dccff14b8b632c5244f1fd506918077221", "versionType": "git"}, {"status": "affected", "version": "00244da40f7821b242c4612428d4192230dba27f", "lessThan": "6c9dddeb582fde005360f4fe02c760d45ca05fb5", "versionType": "git"}], "programFiles": ["crypto/krb5/krb5_api.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.39", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["crypto/krb5/krb5_api.c"], "defaultStatus": "affected"}]}], "published": "2026-07-25T10:17:28.447", "references": [{"url": "https://git.kernel.org/stable/c/2b7bd6dccff14b8b632c5244f1fd506918077221", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6c9dddeb582fde005360f4fe02c760d45ca05fb5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ef6feb77e2d91761427c5b773edc9c97e1b706ad", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5 - filter out async aead implementations at alloc\n\nkrb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and\nrfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL\ncompletion callback and treat any negative return from\ncrypto_aead_{encrypt,decrypt}() as terminal, falling through to\nkfree_sensitive(buffer). When the encrypt_name resolves to an\nasync AEAD instance the request returns -EINPROGRESS, the buffer\nis freed while the backend's worker still holds a pointer, and the\nworker dereferences the freed slab on completion.\n\nKASAN report under UML+SLUB with a synthetic async aead backend\nbound to krb5->encrypt_name:\n\n BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7\n\nThe helpers were written synchronously, so filter the async\ninstances out at allocation time instead of plumbing\ncrypto_wait_req() through every call site.\n\nReachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and\nnet/ceph/crypto.c on systems with an async AEAD provider bound to\nthe krb5 enctype name."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: krb5 - filtrar implementaciones AEAD as\u00edncronas en la asignaci\u00f3n\n\nkrb5_aead_encrypt(), krb5_aead_decrypt() en rfc3961_simplified.c y rfc8009_encrypt(), rfc8009_decrypt() en rfc8009_aes2.c establecen una devoluci\u00f3n de llamada de finalizaci\u00f3n NULL y tratan cualquier retorno negativo de crypto_aead_{encrypt,decrypt}() como terminal, pasando a kfree_sensitive(buffer). Cuando el encrypt_name se resuelve en una instancia AEAD as\u00edncrona, la solicitud devuelve -EINPROGRESS, el b\u00fafer es liberado mientras el trabajador del backend a\u00fan mantiene un puntero, y el trabajador desreferencia el slab liberado al finalizar.\n\nInforme KASAN bajo UML+SLUB con un backend AEAD as\u00edncrono sint\u00e9tico vinculado a krb5 -> encrypt_name:\n\nBUG: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en t5_stub_complete+0x7d/0xc7\n\nLos ayudantes fueron escritos de forma s\u00edncrona, as\u00ed que filtrar las instancias as\u00edncronas en el momento de la asignaci\u00f3n en lugar de pasar crypto_wait_req() a trav\u00e9s de cada sitio de llamada.\n\nAlcanzable a trav\u00e9s de net/rxrpc/rxgk.c, fs/afs/cm_security.c y net/ceph/crypto.c en sistemas con un proveedor AEAD as\u00edncrono vinculado al nombre de tipo de cifrado krb5."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DA3E752-10DF-4260-A04E-FB6A07086768", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}