The Linux kernel's krb5 crypto code contained a use-after-free vulnerability triggered when asynchronous AEAD implementations were bound to the krb5 encryption name. Specifically, krb5_aead_encrypt() and krb5_aead_decrypt() functions set a NULL completion callback and treat any negative return from crypto_aead_encrypt() or crypto_aead_decrypt() as terminal, freeing the buffer immediately. However, when an async AEAD instance returns -EINPROGRESS, the buffer is freed prematurely while the backend worker still holds a pointer, causing a use-after-free on completion. The vulnerability was detected via KASAN under UML+SLUB with a synthetic async AEAD backend. The resolution filters out async AEAD instances at allocation time rather than modifying all call sites to handle asynchronous requests properly. This issue is reachable through several kernel components using krb5 crypto with async AEAD providers.

The vulnerability can lead to use-after-free memory corruption in the kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited. However, no known exploits in the wild have been reported. The impact is limited to systems where an asynchronous AEAD provider is bound to the krb5 encryption name and the vulnerable kernel code paths are exercised.

A fix has been implemented in the Linux kernel that filters out asynchronous AEAD implementations at allocation time to prevent use-after-free conditions. Users should apply the official kernel update containing this fix. Since this is a kernel-level vulnerability, upgrading to the patched kernel version is the recommended mitigation. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.