CVE-2026-80924crypto: krb5 - use kfree_sensitive() for derived key buffers
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree_sensitive() for derived key buffers crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() free the buffer holding the freshly derived keys with plain kfree(), leaving the key material behind in the freed slab object.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 10, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 3936f02bf2d3308a7359dd37dd96cd60603d8170 builds before 731a5b6fb4c1705f9405d9029dd64ea81e336207; 3936f02bf2d3308a7359dd37dd96cd60603d8170 builds before 91b96dc9cc250cd16751f53de525cf3442ca0962; from 3936f02bf2d3308a7359dd37dd96cd60603d8170 before a1bf79365794783b19f5b09e8a23f7ee311e8931; from 3936f02bf2d3308a7359dd37dd96cd60603d8170 before f7d53dd3f267e46a784f219a75072f2f400d42b9 | CNA record |
References
- https://git.kernel.org/stable/c/731a5b6fb4c1705f9405d9029dd64ea81e336207
- https://git.kernel.org/stable/c/91b96dc9cc250cd16751f53de525cf3442ca0962
- https://git.kernel.org/stable/c/a1bf79365794783b19f5b09e8a23f7ee311e8931
- https://git.kernel.org/stable/c/f7d53dd3f267e46a784f219a75072f2f400d42b9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.