CVE-2026-40355: 
Kerberos vulnerability analysis and mitigation

CVE-2026-40355 is a NULL pointer dereference vulnerability in MIT Kerberos 5 (krb5) that allows an unauthenticated remote attacker to crash a process by sending a specially crafted NegoEx message. It affects krb5 versions 1.18 through before 1.22.3, and is triggered when an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. The vulnerability was reported by Cem Onat Karagun and publicly disclosed on April 28, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a missing NULL check in parse_nego_message() within src/lib/gssapi/spnego/negoex_util.c (CWE-476: NULL Pointer Dereference). Specifically, the return value of the second call to vector_base() — which computes a pointer into the NegoEx message buffer based on attacker-controlled offset and count fields — was not validated before being dereferenced. An unauthenticated attacker can send a crafted SPNEGO/NegoEx token over the network to any service using gss_accept_sec_context(), triggering the dereference and causing the process to terminate. The fix adds a NULL check after vector_base() and returns GSS_S_DEFECTIVE_TOKEN with ERR_NEGOEX_INVALID_MESSAGE_SIZE if the pointer is NULL (krb5 commit, GitHub Advisory).

Successful exploitation results in a denial of service (DoS) by causing the affected process to terminate abruptly. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Any network-accessible service that uses the MIT krb5 GSS-API library for authentication and has a NegoEx mechanism configured in /etc/gss/mech is at risk, which could include SSH servers, web servers with Kerberos authentication, and other enterprise services (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify network services (e.g., SSH, HTTP with Kerberos, LDAP) on target systems running MIT krb5 versions 1.18–1.22.2 with a NegoEx mechanism registered in /etc/gss/mech.
2. Craft malicious SPNEGO token: Construct a SPNEGO/NegoEx token where the NEGO_MESSAGE body contains an offset and count field combination that causes vector_base() to return NULL (e.g., an out-of-bounds or zero-length extension array).
3. Send token to target: Transmit the crafted token as part of a GSS-API security context initiation (e.g., during Kerberos/SPNEGO handshake) to the target service without any prior authentication.
4. Trigger crash: The server-side parse_nego_message() function dereferences the NULL pointer returned by vector_base(), causing the service process to terminate with a segmentation fault, resulting in denial of service (krb5 commit, GitHub Advisory).

• Logs: Segmentation fault or crash entries in system logs (e.g., /var/log/syslog, /var/log/messages) referencing the affected service process; core dump files generated by the service process.
• Process: Unexpected termination of services using GSS-API/Kerberos authentication (e.g., sshd, httpd, kadmind); repeated service restarts logged by systemd or init.
• Network: Unusual or malformed SPNEGO/NegoEx authentication tokens in network traffic to Kerberos-enabled services, particularly from unexpected source IPs; repeated failed authentication attempts followed by service crashes.

The primary remediation is to upgrade MIT Kerberos 5 to version 1.22.3 or later, which includes the fix in commit 2e75f0d (krb5 commit). Red Hat has issued patches for RHEL 8 (RHSA-2026:16799), RHEL 9 (RHSA-2026:19357), and RHEL 10 (RHSA-2026:19145) (Red Hat Bugzilla). IBM has also addressed this in IBM Cloud Pak for Data System (IBM Advisory). As a workaround where patching is not immediately possible, remove or disable NegoEx mechanism entries from /etc/gss/mech, or restrict network access to services using Kerberos GSS-API authentication.

The vulnerability received coverage across Linux distribution security channels, with Fedora, openSUSE, Debian, AlmaLinux, Rocky Linux, Amazon Linux 2023, and SUSE all issuing security advisories and updated packages within weeks of disclosure. Microsoft also published an entry in its Security Response Center update guide for this CVE. The vulnerability was noted alongside a companion issue CVE-2026-40356 (a read overrun in parse_message()), both reported by Cem Onat Karagun and fixed in the same commit (krb5 commit).