CVE-2026-80924

The Linux kernel's crypto/krb5 subsystem (Kerberos 5 crypto profiles in the kernel crypto API) frees freshly derived key buffers in crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() with plain kfree() instead of kfree_sensitive(), so derived key material is left behind in freed slab objects rather than being zeroed. The flaw is triggered whenever these code paths derive and then release key buffers during in-kernel Kerberos-based crypto operations. An attacker does not gain a direct remote exploit; the practical risk is that long-lived key material lingers in reusable slab memory, where a separate memory-disclosure bug or side channel could expose it, matching the CVSS profile of network-accessible, high-confidentiality impact with no integrity or availability loss. Anyone running a Linux kernel that includes this crypto/krb5 code and exercises these Kerberos crypto paths is potentially affected; specific affected/fixed version ranges were not provided in the disclosure. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and no exploitation has been reported.

What to do: Apply the kernel update containing the kfree_sensitive() fix when it reaches your distribution's stable kernel repositories, and prioritize reviewing whether any in-house workloads invoke the kernel crypto API's Kerberos 5 profiles. As an interim measure, avoid using the in-kernel krb5 crypto paths for long-lived keys, and treat any co-located memory-disclosure vulnerabilities in the same kernel as higher priority because they could chain with this key-residue issue. Note that no fixed version numbers are given in the disclosure, so verify the fix commit via your vendor's advisory.