Use-After-Free Vulnerability in Kerberos Credential Manager from Red Hat
CVE-2026-104034

4.7MEDIUM

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 6 October 2026

What is CVE-2026-104034?

A vulnerability exists in the Kerberos Credential Manager (KCM) responder related to the renewal of Kerberos ticket-granting tickets (TGT). This flaw allows for a use-after-free scenario where a callback attempts to access memory that has already been released. An authenticated local user possessing a renewable Kerberos ticket can exploit this flaw on systems with KCM renewal enabled, triggering crashes in the KCM responder service and resulting in a Denial of Service (DoS).

References

https://access.redhat.com/security/cve/CVE-2026-104034

vdb-entryx_refsource_REDHAT

https://bugzilla.redhat.com/show_bug.cgi?id=2479178

issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:

4.7

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Local

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 6, 2026
Vulnerability Reserved
Oct 1, 2026

Credit

This issue was discovered by Found by AISLE in partnership with Red Hat.

CVE-2026-104034 Data

JSON