CVE-2026-64439

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the Linux kernel's crypto krb5 implementation. The functions krb5 aead encrypt(), krb5 aead decrypt(), rfc8009 encrypt(), and rfc8009 decrypt() set a NULL completion callback and treat negative returns from crypto aead encrypt() and crypto aead decrypt() as terminal, leading to the execution of kfree sensitive(buffer). If the encrypt name resolves to an asynchronous AEAD instance, the request returns -EINPROGRESS, causing the buffer to be freed while the backend worker still holds a pointer to it. The worker then dereferences this freed slab upon completion. This is reachable via net/rxrpc/rxgk.c, fs/afs/cm security.c, and net/ceph/crypto.c on systems using an asynchronous AEAD provider bound to the krb5 enctype name.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.