CVE-2026-31719 Overview
CVE-2026-31719 is a Linux kernel vulnerability in the krb5enc crypto template that bypasses integrity verification during asynchronous decryption. The function krb5enc_dispatch_decrypt() incorrectly assigns the caller's completion handler to req->base.complete, causing the skcipher to signal completion without invoking krb5enc_dispatch_decrypt_hash(). As a result, the hash check that validates ciphertext integrity is skipped on the async path, breaking the authenticated decryption guarantee Kerberos relies on.
Critical Impact
Network attackers can deliver tampered Kerberos-encrypted payloads that pass through the decrypt path without integrity verification, undermining authenticity guarantees provided by krb5enc.
Affected Products
- Linux Kernel (mainline, multiple stable branches)
- Linux Kernel 7.1-rc1
- Distributions shipping the crypto/krb5enc module
Discovery Timeline
- 2026-05-01 - CVE-2026-31719 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-31719
Vulnerability Analysis
The krb5enc template implements the encrypt-then-MAC construction used by Kerberos, chaining a symmetric cipher (skcipher) with a keyed hash (ahash). On decrypt, the kernel must first run the cipher and then verify the hash before returning plaintext to the caller. The encrypt path correctly registers krb5enc_encrypt_done as an intermediate callback so that asynchronous skcipher completion advances into hash computation. The decrypt path does not. Instead, krb5enc_dispatch_decrypt() sets req->base.complete directly to the caller's completion routine. When the underlying skcipher finishes asynchronously, the caller is notified that decryption is done while krb5enc_dispatch_decrypt_hash() never runs.
The defect is classified under [CWE-NVD-noinfo] but maps to a missing integrity check in authenticated decryption. A secondary defect compounds the issue: krb5enc_request_complete() swallowed EINPROGRESS notifications that backlogged callers depend on, and krb5enc_encrypt_ahash_done lacked an EBUSY check on the dispatch_encrypt return value.
Root Cause
The root cause is an incorrect callback wiring in the asynchronous decrypt dispatch logic. The encrypt path uses an intermediate trampoline to chain skcipher completion into hash computation. The decrypt path skipped that trampoline and exposed the caller's completion handler directly to the skcipher, breaking the encrypt-then-MAC verification ordering.
Attack Vector
An attacker positioned on the network path can submit modified ciphertext to a Kerberos service that uses krb5enc with an asynchronous skcipher implementation. Because the hash verification is bypassed on async completion, forged or tampered messages can be accepted as valid plaintext, violating the integrity property expected from authenticated encryption. Exploitation does not require authentication or user interaction.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-31719
Indicators of Compromise
- Kerberos services accepting messages whose hash verification should have failed, evidenced by application-level authentication anomalies.
- Unexpected successful decryption events on systems using async-capable skcipher backends (for example, hardware crypto offload drivers).
- Kernel logs showing missing or out-of-order completion callbacks from the crypto/krb5enc subsystem.
Detection Strategies
- Inventory hosts running affected kernel versions using uname -r and compare against the patched commits 07cbb1bd4243, 3bfbf5f0a99c, and e51f42114abb.
- Audit kernel build configurations for CONFIG_CRYPTO_KRB5ENC and identify systems where async crypto offload drivers are loaded alongside Kerberos services.
- Correlate Kerberos authentication failures and replay-detection events from KDCs with kernel version data to surface hosts processing unverified ciphertext.
Monitoring Recommendations
- Monitor for unsigned kernel modules loaded into the crypto API and alert on changes to the crypto/krb5enc code path.
- Track Kerberos service logs for repeated decrypt successes followed by upstream protocol errors that suggest integrity drift.
- Ingest kernel and authentication telemetry into a centralized data lake to enable retroactive hunting once patched kernels are deployed.
How to Mitigate CVE-2026-31719
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the Linux Kernel commit 07cbb1bd4243, commit 3bfbf5f0a99c, and commit e51f42114abb.
- Reboot affected hosts after patching to ensure the corrected krb5enc module is loaded.
- Prioritize Kerberos KDCs, NFSv4 servers, and SMB/CIFS gateways that rely on kernel Kerberos crypto.
Patch Information
The fix introduces krb5enc_decrypt_done as an intermediate callback that chains into krb5enc_dispatch_decrypt_hash() on async skcipher completion, mirroring the encrypt path. It removes krb5enc_request_complete() so that EINPROGRESS notifications propagate to backlogged callers, adds the missing EBUSY check in krb5enc_encrypt_ahash_done, and unsets MAY_BACKLOG on the async completion path to prevent duplicate EINPROGRESS notifications. Distribution kernels should pull the upstream fix into their stable trees.
Workarounds
- Where patching is delayed, disable async skcipher offload backends so that krb5enc falls back to synchronous execution, which exercises the correct code path.
- Restrict network exposure of Kerberos-dependent services using firewall ACLs until kernels are updated.
- Audit and remove unused crypto offload drivers from systems that do not require hardware acceleration.
# Verify running kernel and loaded crypto modules
uname -r
lsmod | grep -E 'krb5enc|skcipher'
# Inspect available crypto algorithms and drivers
cat /proc/crypto | grep -A2 krb5enc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
