{"id":"CVE-2026-31719","title":"crypto: krb5enc - fix async decrypt skipping hash verification","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5enc - fix async decrypt skipping hash verification\n\nkrb5enc_dispatch_decrypt() sets req->base.complete as the skcipher\ncallback, which is the caller's own c…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= d1775a177f7f38156d541c8a3e3c91eaa6e69699 < 07cbb1bd424370671814a862913c99a6e1441588","Linux >= d1775a177f7f38156d541c8a3e3c91eaa6e69699 < e51f42114abbdf47f29dda43e7826be28907fcd2","Linux >= d1775a177f7f38156d541c8a3e3c91eaa6e69699 < 3bfbf5f0a99c991769ec562721285df7ab69240b","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:12:50.260721Z"},"published":"2026-05-01","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:25.520Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31719","references":[{"url":"https://git.kernel.org/stable/c/07cbb1bd424370671814a862913c99a6e1441588"},{"url":"https://git.kernel.org/stable/c/e51f42114abbdf47f29dda43e7826be28907fcd2"},{"url":"https://git.kernel.org/stable/c/3bfbf5f0a99c991769ec562721285df7ab69240b"}],"tags":["cve.org"],"epss":0.00506,"epssPercentile":0.41885,"ingestedAt":"2026-10-16T17:24:46.672Z","slug":"CVE-2026-31719","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5enc - fix async decrypt skipping hash verification\n\nkrb5enc_dispatch_decrypt() sets req->base.complete as the skcipher\ncallback, which is the caller's own completion handler. When the\nskcipher completes asynchronously, this signals \"done\" to the caller\nwithout executing krb5enc_dispatch_decrypt_hash(), completely bypassing\nthe integrity verification (hash check).\n\nCompare with the encrypt path which correctly uses\nkrb5enc_encrypt_done as an intermediate callback to chain into the\nhash computation on async completion.\n\nFix by adding krb5enc_decrypt_done as an intermediate callback that\nchains into krb5enc_dispatch_decrypt_hash() upon async skcipher\ncompletion, matching the encrypt path's callback pattern.\n\nAlso fix EBUSY/EINPROGRESS handling throughout: remove\nkrb5enc_request_complete() which incorrectly swallowed EINPROGRESS\nnotifications that must be passed up to callers waiting on backlogged\nrequests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done\nfor the dispatch_encrypt return value.\n\n\nUnset MAY_BACKLOG on the async completion path so the user won't\nsee back-to-back EINPROGRESS notifications.\n\n## Affected\n\n- `Linux >= d1775a177f7f38156d541c8a3e3c91eaa6e69699 < 07cbb1bd424370671814a862913c99a6e1441588`\n- `Linux >= d1775a177f7f38156d541c8a3e3c91eaa6e69699 < e51f42114abbdf47f29dda43e7826be28907fcd2`\n- `Linux >= d1775a177f7f38156d541c8a3e3c91eaa6e69699 < 3bfbf5f0a99c991769ec562721285df7ab69240b`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}