Executive brief
A vulnerability was identified in the Linux kernel's Kerberos 5 (krb5) crypto library and the rxrpc network protocol. These components are used for secure network communications and data verification. The issue involves a lack of proper length checks before decrypting or verifying messages, which could potentially lead to system instability or improper handling of network packets.
Technical details
A vulnerability exists in the Linux kernel's crypto/krb5 and net/rxrpc components due to missing length checks prior to decryption and verification operations. Specifically, the krb5 library did not validate if a message was large enough to contain required cryptographic elements (such as nonces and checksums) before processing. This impacted AF_RXRPC when using RxGK-secured DATA packets. The fix introduces 'crypto_krb5_check_data_len' and updates 'crypto_krb5_where_is_the_data' to return error codes (EBADMSG) if message lengths are insufficient, ensuring that malformed or truncated packets are rejected before cryptographic processing.
Affected products
- Linux Linux Kernel 6.16 to 6.18.34, 7.0 to 7.0.11
Timeline
- 2026-05-16: patched: Initial patch authored by David Howells
- 2026-07-24: disclosed: CVE published to NVD dataset