DEBIAN-CVE-2026-64439

In the Linux kernel, the following vulnerability has been resolved:  crypto: krb5 - filter out async aead implementations at alloc  krb5aeadencrypt(), krb5aeaddecrypt() in rfc3961simplified.c and rfc8009encrypt(), rfc8009decrypt() in rfc8009aes2.c set a NULL completion callback and treat any negative return from cryptoaead{encrypt,decrypt}() as terminal, falling through to kfreesensitive(buffer).  When the encryptname resolves to an async AEAD instance the request returns -EINPROGRESS, the buffer is freed while the backend's worker still holds a pointer, and the worker dereferences the freed slab on completion.  KASAN report under UML+SLUB with a synthetic async aead backend bound to krb5->encryptname:    BUG: KASAN: slab-use-after-free in t5stubcomplete+0x7d/0xc7  The helpers were written synchronously, so filter the async instances out at allocation time instead of plumbing cryptowaitreq() through every call site.  Reachable via net/rxrpc/rxgk.c, fs/afs/cmsecurity.c and net/ceph/crypto.c on systems with an async AEAD provider bound to the krb5 enctype name.