Red Hat Patches Nineteen Kerberos Flaws Affecting Enterprise Linux 10 Authentication Servers
Red Hat published security advisory RHSA-2026:99624 on 12 November 2026, an update for the krb5 packages on Red Hat Enterprise Linux 10 that carries a vendor severity rating of Important. The update resolves nineteen separate CVEs in MIT Kerberos, the network authentication system that allows clients and servers to authenticate to one another through a trusted third party, the Kerberos key distribution center. Affected builds span Red Hat Enterprise Linux for x86_64 10, Red Hat Enterprise Linux for IBM z Systems 10 on s390x, Red Hat Enterprise Linux for Power little endian 10 on ppc64le, and Red Hat Enterprise Linux for ARM 64 10 on aarch64. The bulk of the fixed issues are denial-of-service conditions in the KDC and in the kadmind administration daemon, a significant number of which the vendor describes as reachable without authentication. A smaller group goes beyond availability: improper authorization through flawed PAC checksum verification (CVE-2026-111423), unauthorized key reset of a protected principal via kpasswd (CVE-2026-107884), request alteration and protected information disclosure in kadmind (CVE-2026-118380), and alteration of authentication indicators inside a CAMMAC container (CVE-2026-71199).
The advisory does not publish proof-of-concept code or step-by-step exploitation detail, so the mechanism is known only to the extent the vendor describes each flaw. On the kadmind side, the unauthenticated issues cluster around the GSS-RPC handshake: memory exhaustion from failed AUTH_GSSAPI_INIT requests (CVE-2026-112323), memory leaks on AUTH_GSSAPI_INIT error paths (CVE-2026-112321), leaks triggered by switching GSS-RPC authentication flavors (CVE-2026-112320), leaks on RPCSEC_GSS buffer decode failure (CVE-2026-112315), and a CPU denial of service in the cleanup of AUTH_GSSAPI client states (CVE-2026-112322). Three further kadmind defects require an authenticated session: unbounded RPC XDR allocation (CVE-2026-112319), dereference of null policy name pointers (CVE-2026-112318), and a leak on xdr_krb5_tl_data() decode failure (CVE-2026-112316). The KDC itself is exposed through a NULL pointer dereference triggered by a crafted PKINIT pre-authentication request (CVE-2026-71200), an ASN.1 decoder read overrun (CVE-2026-107364), quadratic ASN.1 SEQUENCE OF decoding that burns CPU (CVE-2026-119079), a leak in the KDB keytab key decryption error path (CVE-2026-112317), a malformed PAC in S4U2Proxy requests (CVE-2026-107708), and crafted forwarded credentials (CVE-2026-107778). Alongside the security fixes, the release bundles a long list of bug and hardening changes covering RPCSEC_GSS context lifecycle leaks, read overruns in GSSRPC svcauth_unix, PKINIT SAN handling, and KDC authdata filtering of types nested inside AD-IF-RELEVANT containers.
The practical concern is placement rather than sophistication. A KDC is the trust anchor for an entire realm, and kadmind is the interface through which principals and policies are managed, so a daemon that leaks memory on every malformed handshake or stalls on a crafted ASN.1 structure can translate into realm-wide authentication outages affecting logins, service tickets and dependent applications. The smaller set of authorization-related defects matters more than their count suggests, because flawed PAC checksum verification, unauthorized key reset of a protected principal and alteration of authentication indicators all touch the correctness of authentication decisions rather than merely the uptime of the service. On current exploitation status, FIRST EPSS places all of the scored issues in the low single digits over the next thirty days: 1.2% for CVE-2026-112314 and CVE-2026-112321, 1.0% for CVE-2026-112322, CVE-2026-112320 and CVE-2026-112319, 0.9% for CVE-2026-112323, CVE-2026-119079 and CVE-2026-112316, and 0.8% for CVE-2026-112318 and CVE-2026-112317. No exploitation data has been published for the remaining CVEs in the advisory, and no confirmed in-the-wild activity is reported for any of them, though absence of evidence is not the same as absence of risk for an internet-adjacent or widely reachable authentication service.
Attack Surface
Infrastructure, Server OS, System Management Service
Tactics
Impact, Credential Access, Privilege Escalation, Defense Evasion
Techniques
- T1499 – Endpoint Denial of Service
- T1498 – Network Denial of Service
- T1068 – Exploitation for Privilege Escalation
- T1558 – Steal or Forge Kerberos Tickets
- T1556 – Modify Authentication Process
SuperPRO's Threat Countermeasures Procedures
- Install the krb5 packages shipped in RHSA-2026:99624 on every Red Hat Enterprise Linux 10 host (x86_64, s390x, ppc64le and aarch64 builds are all covered); this single update resolves all nineteen CVEs including CVE-2026-111423, CVE-2026-107884, CVE-2026-118380 and CVE-2026-71199, with the update procedure documented at https://access.redhat.com/articles/11258.
- Enumerate Red Hat Enterprise Linux 10 hosts against the affected builds listed in RHSA-2026:99624 (x86_64, s390x, ppc64le and aarch64) using rpm -q krb5-server krb5-libs, and treat hosts running krb5kdc and the kadmind administration daemon as the first targets for the update ahead of client-only krb5-libs installs.
- Restart the krb5kdc and kadmin services after the package upgrade (systemctl restart krb5kdc kadmin), since long-running daemons keep the vulnerable code mapped and the leak and dereference fixes only take effect on a fresh process.
- Restrict kadmind on TCP/749 and the kpasswd service on UDP/464 to administrative subnets or jump hosts with host firewall rules, as the pre-authentication kadmind defects CVE-2026-112315, CVE-2026-112320, CVE-2026-112321, CVE-2026-112322 and CVE-2026-112323 are reachable by anything able to open an RPC connection.
- Filter and rate-limit KDC traffic on port 88 UDP and TCP from untrusted networks, which limits exposure to the unauthenticated KDC issues CVE-2026-71200 (crafted PKINIT pre-auth NULL dereference), CVE-2026-107364 (ASN.1 read overrun) and CVE-2026-119079 (quadratic ASN.1 SEQUENCE OF CPU exhaustion).
- Where the krb5 update from RHSA-2026:99624 cannot yet be applied to a RHEL 10 KDC, narrow the set of principals granted kadmin administrative rights, since the kadmind defects CVE-2026-112316 (xdr_krb5_tl_data() decode leak), CVE-2026-112318 (null policy name dereference) and CVE-2026-112319 (unbounded RPC XDR allocation) are reachable only from an authenticated administrative session.
- On RHEL 10 KDCs that do not use certificate-based authentication, leave the PKINIT pre-authentication plugin unconfigured in krb5kdc, which removes reachability of the crafted PKINIT pre-authentication NULL pointer dereference CVE-2026-71200 on hosts awaiting the krb5 packages from RHSA-2026:99624.
