Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-64208

crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AF_RXRPC to make use of this to validate DATA packets secured with RxGK.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a to < 585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ffaffected
  • 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a to < 9217017f4bce53dddb8d547837f1f707045d64adaffected
  • 9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a to < 2b50aceafe6606ea52ed42aadd1b4d44a188aadeaffected

Linux Linux

Default version status: affected

  • 6.16affected
  • 0 to < 6.16unaffected
  • 6.18.34 to ≤ 6.18.*unaffected
  • 7.0.11 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References