Kerberos contains an integer underflow vulnerability in the berval2tl_data() function (CVE-2026-11850) and vulnerabilities in the NegoEx mechanism parsing (CVE-2026-40355, CVE-2026-40356). These flaws could be exploited by a remote attacker to cause Kerberos to crash, resulting in denial of service. The vulnerabilities affect multiple versions of Kerberos packages distributed with Ubuntu and Red Hat Hardened Images. Vendor advisories from Ubuntu and Red Hat confirm the issues and provide updated package versions that fix these vulnerabilities.

Successful exploitation of these vulnerabilities can cause Kerberos services to crash, leading to denial of service conditions. There is no indication of privilege escalation, data disclosure, or code execution. No known exploits in the wild have been reported.

A patch is available from both Ubuntu and Red Hat. Users should update their Kerberos packages to the fixed versions as specified in the vendor advisories and restart Kerberos services to apply the changes. No additional mitigation is required beyond applying the official updates.