CVE-2026-64208

A flaw was found in the Linux kernel's krb5 crypto library and AF_RXRPC component. This vulnerability arises from a lack of proper length checks before decrypting or verifying incoming messages. A remote attacker could exploit this by sending specially crafted messages, leading to a Denial of Service (DoS) condition where the system becomes unavailable.

This vulnerability is rated as having a Moderate impact by Red Hat because successful exploitation requires an active RxRPC session utilizing the RxGK security mechanism, limiting exposure to specialized deployments. While processing improperly bounded incoming network packets can cause a denial of service, the underlying networking and cryptographic support is not utilized by default. In addition, older enterprise releases, including Red Hat Enterprise Linux 8 and 9, do not incorporate the vulnerable code and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.