Keep verifier cred locked in accept_sec_context It might have been safe to access the krb5 verifier cred without a lock before constrained delegation, but it is less likely to be safe now that we might access both the initiator and acceptor parts of the cred. Hold a lock on the cred for the full accept_sec_context operation. https://github.com/krb5/krb5/commit/7889227a9651677a2bba6b57041c4d53b6621822 Author: Greg Hudson Commit: 7889227a9651677a2bba6b57041c4d53b6621822 Branch: master src/lib/gssapi/krb5/accept_sec_context.c | 30 +++++++++++++++--------------- 1 files changed, 15 insertions(+), 15 deletions(-)