Linux Kernel EUVD-2026-75101

The vulnerable code path is only exercised when Kerberos-authenticated kernel crypto services are active - specifically NFSv4 mounts configured with sec=krb5, sec=krb5i, or sec=krb5p, or CIFS/SMB shares using Kerberos authentication at the kernel level. The kernel version must contain commit 3936f02bf2d3308a7359dd37dd96cd60603d8170 and not yet include one of the four stable backport fixes. Extracting the leaked key material further requires a mechanism to read freed kernel slab memory: access to an unencrypted crash dump, a readable /proc/kcore, or a chained kernel memory disclosure vulnerability. The assigned AV:N/PR:N CVSS vector implying unauthenticated remote exploitation is not consistent with this exploitation model; local kernel memory access is the actual limiting requirement.

The formally assigned CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H scores 7.5 but substantially overstates exploitability for this vulnerability class. Recovering sensitive data from freed kernel slab memory is not a remote network operation - it requires local access to kernel memory, typically via crash/core dumps, a readable /proc/kcore interface, or a chained secondary kernel memory-disclosure primitive. The AV:N designation is inconsistent with the actual attack model and should be treated as suspect; even a mid-sized municipal IT team in rybnik evaluating patch urgency should weigh this discrepancy before escalating to emergency response. This CVE is not listed in CISA KEV, no public exploit code exists, and no EPSS score is provided in the input. In practice, this is a defense-in-depth hardening fix: real-world risk is constrained to environments where Kerberos kernel services are active and where an attacker can already access kernel memory through some secondary mechanism, making the effective impact window narrow despite the formally stated High confidentiality impact.

An attacker with local access to a Linux server running NFSv4 with sec=krb5 authentication chains this vulnerability with a secondary kernel memory-read primitive - such as access to a crash dump or an information-leak from another kernel bug - to read freed slab objects containing Kerberos-derived session key material left by crypto_krb5_prepare_encryption(). With the recovered key material, the attacker could decrypt previously captured Kerberos-protected NFS traffic or forge authentication tokens for active sessions. No proof-of-concept exploit exists, and the chained exploitation requirement significantly raises the practical difficulty bar.