CVE-2026-80924

What it actually does

crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() free derived Kerberos key buffers using plain kfree() instead of kfree_sensitive(), leaving residual key material in slab objects that may later be reallocated and read.

Why it matters to the business

Cryptographic key material used for Kerberos authentication may be recoverable from kernel memory, undermining the confidentiality of encrypted communications and authentication tokens across affected systems.

How an attack unfolds

An attacker triggers the vulnerable krb5 key derivation paths, after which the freed slab pages containing key bytes are reallocated to attacker-controlled structures or inspected via kernel memory disclosure primitives, allowing extraction of the sensitive key material.

How to fix it

Apply the upstream kernel patch that replaces kfree with kfree_sensitive for the affected krb5 key buffers; rebuild and deploy updated kernel packages to all affected hosts.

How to confirm the fix worked

Confirm the source change replaces kfree with kfree_sensitive in crypto_krb5_prepare_encryption and crypto_krb5_prepare_checksum; run kernel regression tests that exercise krb5 key derivation and verify no key material remains in slab caches after free.

Typical attack path

1. Reach a code path that invokes crypto_krb5_prepare_encryption or crypto_krb5_prepare_checksum
2. Allow the kernel to free the derived-key buffer with kfree
3. Trigger slab reallocation that maps the same memory to attacker-influenced objects
4. Read the reallocated memory to obtain the still-present key bytes

How to detect it

Search kernel slab and memory-leak logs, or use memory forensic tools, for patterns consistent with krb5 key derivation buffers freed without clearing; no network or user-space artifacts are directly observable.

What your security team should do

• Prioritize kernel updates on all systems that enable the krb5 crypto modules
• Monitor upstream stable and distribution kernel releases for the backported fix
• Audit any custom kernel builds or out-of-tree krb5 crypto consumers for the same pattern