CVE-2026-119079

This vulnerability is evaluated as an Important severity issue because remote unauthenticated attackers can cause excessive CPU consumption and degrade KDC availability without requiring valid credentials or user interaction. In Red Hat Enterprise Linux environments, this impact specifically targets the krb5kdc daemon when listening for incoming TCP traffic from untrusted networks. Systems where the Kerberos Key Distribution Center is restricted to trusted subnets experience lower operational risk, and the flaw cannot be leveraged for unauthorized data disclosure or remote code execution.

Restrict incoming TCP traffic on port 88 to trusted internal networks or authorized administrative hosts using firewalld.

1. Add a rich rule permitting TCP port 88 only from trusted networks (substitute with the appropriate network CIDR):

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="88" protocol="tcp" accept'

2. Ensure unauthenticated or public access to port 88/tcp is removed:

firewall-cmd --permanent --remove-port=88/tcp

3. Apply the changes:

firewall-cmd --reload

Warning: Applying firewall changes requires reloading firewalld, which may temporarily disrupt network traffic. Restricting TCP access will prevent clients outside the allowed network range from falling back to TCP for large Kerberos ticket exchanges.