What is the CVSS score of EUVD-2026-48783?

EUVD-2026-48783 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-48783?

A use-after-free in the Linux kernel's Kerberos crypto component affects systems running kernels 6.15-6.18.38 with asynchronous hardware crypto acceleration enabled, potentially causing service…. A patch is available.

How to fix or mitigate EUVD-2026-48783?

Within 24 hours, identify systems running affected kernel versions (6.15-6.18.38 or distribution equivalents) and assess whether async AEAD crypto acceleration is configured, particularly those using Kerberos authentication or Ceph/AFS storage. Within 7 days, plan kernel upgrades to patched versions (6.18.39 or later, 7.1.4 or later, or 7.2-rc1 or later depending on your kernel branch) and schedule maintenance windows where needed. Within 30 days, complete kernel updates across all identified systems and validate Kerberos authentication and crypto-accelerated services remain functional post-deployment.

Linux Kernel EUVD-2026-48783

| CVE-2026-64439 CRITICAL

Use After Free (CWE-416)

2026-07-25 Linux

GHSA-f86v-42xw-q4vj

Linux Use After Free Memory Corruption

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Reachable over network via kerberised rxrpc/AFS/Ceph but gated on a non-default async AEAD provider and a completion race (AC:H) and an authenticated krb5 session (PR:L); impact is memory-corruption crash, so A:H only, C/I:N.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 09:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Jul 27, 2026 - 05:54 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

9.8 (CRITICAL)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:51 cve.org

CRITICAL 9.8

CVE Published

Jul 25, 2026 - 08:51 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: krb5 - filter out async aead implementations at alloc

krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion callback and treat any negative return from crypto_aead_{encrypt,decrypt}() as terminal, falling through to kfree_sensitive(buffer). When the encrypt_name resolves to an async AEAD instance the request returns -EINPROGRESS, the buffer is freed while the backend's worker still holds a pointer, and the worker dereferences the freed slab on completion.

KASAN report under UML+SLUB with a synthetic async aead backend bound to krb5->encrypt_name:

BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7

The helpers were written synchronously, so filter the async instances out at allocation time instead of plumbing crypto_wait_req() through every call site.

Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and net/ceph/crypto.c on systems with an async AEAD provider bound to the krb5 enctype name.

AnalysisAI

Use-after-free in the Linux kernel's crypto/krb5 helper library (introduced in 6.15) occurs when Kerberos AEAD encrypt/decrypt operations are backed by an asynchronous AEAD implementation. The synchronous helpers in rfc3961_simplified.c and rfc8009_aes2.c set a NULL completion callback and treat any negative return as terminal, so an async backend returning -EINPROGRESS causes the buffer to be freed with kfree_sensitive() while the backend worker still dereferences it. This is reachable through kernel consumers of krb5 crypto (rxrpc/rxgk, AFS cm_security, and Ceph), but only on systems where an async AEAD provider is bound to the krb5 enctype name; no public exploit identified at time of analysis and EPSS is low at 0.21%.

Technical ContextAI

The affected code is the in-kernel Kerberos v5 cryptographic library (crypto/krb5), added around kernel 6.15, which implements RFC 3961 simplified-profile and RFC 8009 AES2 enctypes on top of the kernel crypto API's AEAD (authenticated encryption with associated data) interface. The kernel crypto API can resolve a given cipher/enctype name to either a synchronous (generic C) implementation or an asynchronous one - typically a hardware offload engine or an async driver - signalled at runtime by crypto_aead_encrypt()/decrypt() returning -EINPROGRESS and completing later via a callback. The krb5 helpers were written on the assumption of synchronous execution: they pass a NULL completion callback and do not use crypto_wait_req(), so an -EINPROGRESS return is misinterpreted as a hard error and the request/output buffer is freed immediately. The async worker then completes and writes into freed slab memory, the classic CWE-416 use-after-free. The fix filters out async AEAD instances at crypto_alloc time (forcing a synchronous implementation) rather than plumbing completion waits through every call site.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 6.18.39, 7.1.4, or 7.2-rc1 (or later), which filter async AEAD instances out at allocation so the synchronous helpers never receive -EINPROGRESS; apply your distribution's fixed package per Ubuntu USN-8726-1 (https://ubuntu.com/security/notices/USN-8727-1 and https://ubuntu.com/security/notices/USN-8726-1). Where immediate patching is not possible, the practical compensating control is to avoid binding an asynchronous AEAD provider to the krb5 enctype name - do not load or register async crypto offload drivers (e.g. hardware accelerators exposing async AES-GCM/HMAC AEAD) for the algorithms used by Kerberos, which forces the generic synchronous implementations and closes the trigger, at the cost of losing any crypto-offload performance benefit. Reducing exposure of the kernel krb5 consumers (rxrpc/rxgk, AFS, Ceph) - for example not mounting Ceph or AFS or not using kerberised rxrpc where unneeded - also removes the reachable code paths.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Use After Free

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

CVE-2012-4969 HIGH POC

8.1

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-48783 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-48783

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Use After Free

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code