A critical use-after-free vulnerability in the Linux kernel crypto krb5 subsystem could allow an unauthenticated attacker to trigger memory corruption and potential code execution.

The vulnerability exists because the krb5 encryption and decryption helpers do not account for asynchronous AEAD instances. When an asynchronous backend returns an EINPROGRESS status, the system prematurely frees a buffer that is still in use by a background worker, resulting in a use-after-free condition upon completion.

The flaw carries a CVSS score of 9.8, indicating a critical severity due to its potential for full system compromise. Successful exploitation could lead to unauthorized code execution, system instability, or full service disruption. Given that this affects core cryptographic functions, it poses a significant risk to the integrity and confidentiality of data processed by the Linux kernel.

Immediate Action: Update the Linux kernel to version 6.18.39, 7.1.4, or later versions where the async AEAD instances are properly filtered at allocation time.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected process terminations, which may indicate memory corruption events associated with this use-after-free flaw.

Compensating Controls: While no direct virtual patch exists for kernel-level memory corruption, restricting access to network services that utilize krb5 encryption (such as rxrpc, AFS, or Ceph) can reduce the attack surface.

Public Exploit Available: Unknown

This vulnerability is highly severe and requires immediate attention for all systems utilizing the affected kernel versions. Administrators should prioritize patching the kernel to the recommended versions to prevent potential memory exploitation. Testing updates in a staging environment is advised to ensure compatibility with existing cryptographic configurations before deployment to production systems.