In the Linux kernel, the following vulnerability has been resolved:
crypto: krb5enc - fix async decrypt skipping hash verification
krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher
callback, which is the caller's own completion handler. When the
skcipher completes asynchronously, this signals "done" to the caller
without executing krb5enc_dispatch_decrypt_hash(), completely bypassing
the integrity verification (hash check).
Compare with the encrypt path which correctly uses
krb5enc_encrypt_done as an intermediate callback to chain into the
hash computation on async completion.
Fix by adding krb5enc_decrypt_done as an intermediate callback that
chains into krb5enc_dispatch_decrypt_hash() upon async skcipher
completion, matching the encrypt path's callback pattern.
Also fix EBUSY/EINPROGRESS handling throughout: remove
krb5enc_request_complete() which incorrectly swallowed EINPROGRESS
notifications that must be passed up to callers waiting on backlogged
requests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done
for the dispatch_encrypt return value.
Unset MAY_BACKLOG on the async completion path so the user won't
see back-to-back EINPROGRESS notifications.
Security readout for executives and security teams
Plain-English summary
A Linux kernel Kerberos encryption component can accept asynchronously decrypted data without checking its integrity. An unauthenticated remote attacker may therefore be able to alter protected data without detection when the vulnerable path is used. The supplied CVSS score is 7.5, driven by high integrity impact; confidentiality and availability impacts are not identified.
Executive priority
Treat this as a high-priority integrity issue, especially on remotely exposed or authentication-sensitive systems using the affected kernel path. Expedite vendor confirmation and patching, while recognizing that the supplied evidence does not establish active exploitation or broad default exposure.
Technical view
In krb5enc_dispatch_decrypt(), asynchronous skcipher completion invoked the caller’s completion handler directly, bypassing krb5enc_dispatch_decrypt_hash(). The kernel fix adds an intermediate callback that performs hash verification and corrects EBUSY, EINPROGRESS, and backlog notification handling. The defect affects integrity verification specifically on the asynchronous decryption path.
Likely exposure
Exposure requires a listed affected Linux kernel and use of krb5enc through asynchronous decryption. The supplied record lists versions 6.15, 6.18.25, 7.0.2, and 7.1 as affected, but also contains an ambiguous “0” entry. Confirm applicability through distribution or kernel vendor guidance.
Exploitation context
The CVSS vector describes network reachability, low complexity, no privileges, and no user interaction. However, the supplied sources provide no confirmed exploitation, public exploit, or demonstrated attack path. The CVE is not identified as being in CISA KEV within the supplied bundle.
Researcher notes
The security boundary failure is callback sequencing: asynchronous completion reported success before authentication hash verification. The correction mirrors the encrypt path by chaining completion into verification. Researchers should also examine backlog and EINPROGRESS regression behavior. Precise distribution package ranges and real-world reachability are not established by the bundle.
Mitigation direction
Apply a vendor kernel update containing the referenced upstream or stable correction.
Check distribution advisories for corrected package versions and reboot requirements.
Prioritize systems that actively use kernel krb5enc asynchronous decryption.
If updates are unavailable, request vendor-supported mitigation guidance.
Validation and detection
Inventory kernel versions on systems using Kerberos-related kernel cryptography.
Confirm the running kernel contains a referenced fix or vendor backport.
Test that modified ciphertext is rejected during asynchronous krb5enc decryption.
Verify the corrected kernel is running after update and reboot.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-31719 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
4Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.