Linux kernel crypto/krb5: derived Kerberos keys left in freed slab memory

Impact

crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() released the buffer holding freshly derived Kerberos keys with plain kfree() instead of kfree_sensitive(), so the key material stays in the freed slab object until that memory is reused. On a GPU node this matters where kerberized NFS (RPCSEC_GSS krb5p/krb5i) is the path to the shared dataset and checkpoint storage: session key material recoverable from reused slab memory undermines the confidentiality of that mount. The record gives no exploit path of its own - recovery requires an attacker who can already read kernel slab contents through some other primitive, so treat this as removing a defence-in-depth failure rather than as a directly reachable bug. The CVSS AV:N vector assigned to the record is not supported by the commit message, which describes only residual key material in freed memory.

Who can reach it

No independent remote path. Requires an attacker who can already read freed kernel slab memory on the host - a local user chaining a separate kernel information-leak, or a compromised kernel context. Nodes that never use kerberized NFS or krb5 RPCSEC_GSS do not reach this code at all.

What to do

Pick up the fix from your distribution's stable kernel (upstream commits linked in the references); it is a one-line change from kfree() to kfree_sensitive() on the derived-key buffers. Applying it means installing a new kernel and rebooting each node, which on a GPU fleet means draining running jobs first. Given the limited exposure, batching this into the next scheduled kernel roll is reasonable rather than opening a window for it alone.

References

Related entries

• Linux kernel (overlayfs, Ubuntu patch): OverlayFS file-capability privilege escalationCVE-2021-3493 · Linux kernel (overlayfs, Ubuntu patch)High
• OpenSSL: X.400 address type confusion in X.509 GeneralNameCVE-2023-0286 · OpenSSLHigh
• Linux kernel (net/sched tcindex): Use-after-free in the tcindex traffic-control filter - local rootCVE-2023-1829 · Linux kernel (net/sched tcindex)High
• QEMU: missing iov bounds check in the virtio-snd input callback gives a guest a heap out-of-bounds writeCVE-2026-3195 · QEMU virtio-snd device (virtio_snd_pcm_in_cb input callback)High
• Linux kernel (arch/x86/kvm/svm): After a CPU offline/online cycle, KVM's ASID generation counter is reset in a way thatCVE-2026-68093 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel (net/xfrm): A qdisc that reuses skbCVE-2023-53500 · Linux kernel (net/xfrm)High