The Linux kernel’s krb5enc module previously omitted the integrity hash check when performing an asynchronous decryption, allowing the kernel to consider the data decrypted without verifying its authenticity. The flaw arises because the decrypt callback directly signals completion to the caller instead of invoking the intermediate hash verification function. This bypass removes a critical check that would normally detect tampered ciphertext. Based on the description, it is inferred that an attacker would need to supply forged Kerberos ciphertext to trigger the vulnerable async decrypt path in kernel space, potentially compromising Kerberos authentication and any encrypted exchanges that rely on it.

All Linux kernel releases that include the old krb5enc path before the commit resolving the async decrypt hash verification are vulnerable. The vulnerability applies to the generic Linux kernel package shipped by most distributions and includes versions such as the mainline kernel and the 7.1 release candidate. Any system running a kernel containing the unpatched krb5enc implementation is affected.

The missing integrity check (CWE‑325) and improper flag handling (CWE‑354) create a high‑severity flaw with a CVSS score of 7.5. The EPSS score indicates a very low but non‑zero exploit probability (<1 %). The CVE is not referenced in the CISA KEV catalog. Based on the description, it is inferred that the attack would target Kerberos clients or services that invoke the asynchronous decrypt interface, requiring the ability to provide crafted ciphertext. Successful exploitation could allow an attacker to inject false credentials or subvert authentication processes, representing a significant threat to systems that rely on Kerberos for secure communication.