CVE-2026-64439

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: krb5 - filter out async aead implementations at alloc<br /> <br /> krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and<br /> rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL<br /> completion callback and treat any negative return from<br /> crypto_aead_{encrypt,decrypt}() as terminal, falling through to<br /> kfree_sensitive(buffer). When the encrypt_name resolves to an<br /> async AEAD instance the request returns -EINPROGRESS, the buffer<br /> is freed while the backend&amp;#39;s worker still holds a pointer, and the<br /> worker dereferences the freed slab on completion.<br /> <br /> KASAN report under UML+SLUB with a synthetic async aead backend<br /> bound to krb5-&gt;encrypt_name:<br /> <br /> BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7<br /> <br /> The helpers were written synchronously, so filter the async<br /> instances out at allocation time instead of plumbing<br /> crypto_wait_req() through every call site.<br /> <br /> Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and<br /> net/ceph/crypto.c on systems with an async AEAD provider bound to<br /> the krb5 enctype name.