LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31719: crypto: krb5enc - fix async decrypt skipping hash verification

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5enc - fix async decrypt skipping hash verification krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher callback, which is the caller's own completion handler. When the skcipher completes asynchronously, this signals "done" to the caller without executing krb5enc_dispatch_decrypt_hash(), completely bypassing the integrity verification (hash check). Compare with the encrypt path which correctly uses krb5enc_encrypt_done as an intermediate callback to chain into the hash computation on async completion. Fix by adding krb5enc_decrypt_done as an intermediate callback that chains into krb5enc_dispatch_decrypt_hash() upon async skcipher completion, matching the encrypt path's callback pattern. Also fix EBUSY/EINPROGRESS handling throughout: remove krb5enc_request_complete() which incorrectly swallowed EINPROGRESS notifications that must be passed up to callers waiting on backlogged requests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done for the dispatch_encrypt return value. Unset MAY_BACKLOG on the async completion path so the user won't see back-to-back EINPROGRESS notifications.

HighCVSS 7.5Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel Kerberos encryption component can accept asynchronously decrypted data without checking its integrity. An unauthenticated remote attacker may therefore be able to alter protected data without detection when the vulnerable path is used. The supplied CVSS score is 7.5, driven by high integrity impact; confidentiality and availability impacts are not identified.

Executive priority

Treat this as a high-priority integrity issue, especially on remotely exposed or authentication-sensitive systems using the affected kernel path. Expedite vendor confirmation and patching, while recognizing that the supplied evidence does not establish active exploitation or broad default exposure.

Technical view

In krb5enc_dispatch_decrypt(), asynchronous skcipher completion invoked the caller’s completion handler directly, bypassing krb5enc_dispatch_decrypt_hash(). The kernel fix adds an intermediate callback that performs hash verification and corrects EBUSY, EINPROGRESS, and backlog notification handling. The defect affects integrity verification specifically on the asynchronous decryption path.

Likely exposure

Exposure requires a listed affected Linux kernel and use of krb5enc through asynchronous decryption. The supplied record lists versions 6.15, 6.18.25, 7.0.2, and 7.1 as affected, but also contains an ambiguous “0” entry. Confirm applicability through distribution or kernel vendor guidance.

Exploitation context

The CVSS vector describes network reachability, low complexity, no privileges, and no user interaction. However, the supplied sources provide no confirmed exploitation, public exploit, or demonstrated attack path. The CVE is not identified as being in CISA KEV within the supplied bundle.

Researcher notes

The security boundary failure is callback sequencing: asynchronous completion reported success before authentication hash verification. The correction mirrors the encrypt path by chaining completion into verification. Researchers should also examine backlog and EINPROGRESS regression behavior. Precise distribution package ranges and real-world reachability are not established by the bundle.

Mitigation direction

  • Apply a vendor kernel update containing the referenced upstream or stable correction.
  • Check distribution advisories for corrected package versions and reboot requirements.
  • Prioritize systems that actively use kernel krb5enc asynchronous decryption.
  • If updates are unavailable, request vendor-supported mitigation guidance.

Validation and detection

  • Inventory kernel versions on systems using Kerberos-related kernel cryptography.
  • Confirm the running kernel contains a referenced fix or vendor backport.
  • Test that modified ciphertext is rejected during asynchronous krb5enc decryption.
  • Verify the corrected kernel is running after update and reboot.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31719 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-31719Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd1775a177f7f38156d541c8a3e3c91eaa6e69699, d1775a177f7f38156d541c8a3e3c91eaa6e69699, d1775a177f7f38156d541c8a3e3c91eaa6e69699unaffected
LinuxLinux6.15, 0, 6.18.25, 7.0.2, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.