Moderate: Red Hat Security Advisory: krb5 security update

An update for krb5 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

The vulnerability of the `ksmbd_krb5_authenticate()` function in the `ksmbd` component of the Linux operating system allows a hacker to induce a service failure.

The vulnerability of the ksmbdkrb5authenticate function in the ksmbd component of the Linux operating system is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to trigger a denial-of-service attack...

RLSA-2025:8411 Moderate: krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

ksmbd: fix use-after-free in kerberos authentication

...

ksmbd: Fix dangling pointer in krb_authenticate

...

SUSE CVE-2025-38191

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroyprevioussession If client set -PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess-user is not set yet, It can pass the user...

AZL-64701 CVE-2025-38191 affecting package kernel for versions less than 6.6.96.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroyprevioussession If client set -PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess-user is not set yet, It can pass the user...

RHEL 10 : krb5 (RHSA-2025:9418)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9418 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending password...

Moderate: Red Hat Security Advisory: krb5 security update

An update for krb5 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Moderate: Red Hat Security Advisory: krb5 security update

An update for krb5 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed a use-after-free issue in Kerberos authentication. The introduction of sess-user = NULL was necessary to fix the dangling pointer created by ksmbdfreeuser. However, it is possible that another thread might be...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed a dangling pointer in krbauthenticate. krbauthenticate frees sess-user and does not set the pointer to NULL. It calls ksmbdkrb5authenticate to reinitialise sess-user, but that function may return without doing so...

Ubuntu 25.04 : Samba vulnerability (USN-7564-1)

The remote Ubuntu 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7564-1 advisory. It was discovered that Samba incorrectly handled certain group membership changes when using Kerberos authentication. A remote user could possibly use this issue to...

USN-7564-1: Samba vulnerability

It was discovered that Samba incorrectly handled certain group membership changes when using Kerberos authentication. A remote user could possibly use this issue to continue to access resources after being removed by an administrator...

[SECURITY] Fedora 42 Update: krb5-1.21.3-6.fc42

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of sending passwords over the network in unencrypted form...

[ASA-202506-3] samba: access restriction bypass

Arch Linux Security Advisory ASA-202506-3 ========================================= Severity: Low Date : 2025-06-06 CVE-ID : CVE-2025-0620 Package : samba Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-2892 Summary ======= The package samba before version...

Samba 4.21.x < 4.21.6 / 4.22.x < 4.22.2 Security Bypass Vulnerability

The version of Samba installed on the remote host is 4.21.x prior to 4.21.6, or 4.22.x prior to 4.22.2. It is, therefore, affected by a security bypass vulnerability. A flaw exists with smbd when using Kerberos authentication with smb, due to using the cached user group permissions when...

ALSA-2025:8411 Moderate: krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

PT-2025-23682

Name of the Vulnerable Software and Affected Versions Samba versions prior to 4.21.6 Description The issue concerns a problem with SMB session re-authentication when using Kerberos authentication with SMB. Specifically, smbd does not pick up group membership changes when re-authenticating an...

The vulnerability of the krb_authenticate() function in the fs/smb/server/smb2pdu.c module of the Linux operating system allows a hacker to induce a service failure.

The vulnerability of the krbauthenticate function in the fs/smb/server/smb2pdu.c module of the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability could allow a attacker to cause a denial-of-service attack...