CVE-2026-94300

A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol (UDP) message signed with Generic Security Service Transaction Signature (GSS-TSIG) can replay it while the negotiated key is active. When combined with crafted queries directed to an attacker-controlled DNS zone, this triggers memory corruption in the named service.

Red Hat Product Security has rated this vulnerability as Important rather than Critical because, while remote unauthenticated code execution is possible, exploitation depends on capturing active cryptographic keys within their validity window and orchestrating complex concurrent requests. In standard Red Hat Enterprise Linux deployments, the BIND daemon does not enable GSS-TSIG by default, restricting risk primarily to servers integrated with Kerberos-based identity infrastructure like FreeIPA or Active Directory. Deployments that do not negotiate GSS-TSIG keys or that strictly limit dynamic DNS access to trusted networks remain unexposed to this attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls.

To disable GSS-TSIG, comment out or remove the tkey-gssapi-keytab and tkey-gssapi-credential directives within /etc/named.conf (and any referenced include files), then restart the service:

systemctl restart named

If operating named inside a chroot environment, execute:

systemctl restart named-chroot

Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access.

Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients.