The advisory covers two denial of service vulnerabilities in MIT Kerberos 5 (krb5) used in Red Hat Enterprise Linux 10. CVE-2026-40356 is caused by an integer underflow leading to an out-of-bounds read, while CVE-2026-40355 results from a NULL pointer dereference in the NegoEx authentication mechanism. Both vulnerabilities can cause service disruption by crashing the krb5 process. Red Hat has released updated krb5 packages to fix these issues. The advisory references Red Hat's errata RHSA-2026:19145 and provides links for applying the update. The vulnerabilities are rated as Important by Red Hat Product Security, but no CVSS base score is provided. No evidence of active exploitation is currently known.

Successful exploitation of these vulnerabilities can cause denial of service conditions by crashing the krb5 service, potentially disrupting network authentication processes that rely on Kerberos. This could affect availability of authentication services on affected Red Hat Enterprise Linux 10 systems. There are no indications of privilege escalation or information disclosure associated with these issues. No known exploits in the wild have been reported.

Red Hat has released official security updates for krb5 that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related variants should apply the updated krb5 packages as provided in Red Hat advisory RHSA-2026:19145. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.