krb5 commit [krb5-1.22]: Fix leak on krb5 gss_accept_sec_context() failure

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/6fc01659503581962f66320c258a3f5abda7b5ef
commit 6fc01659503581962f66320c258a3f5abda7b5ef
Author: Greg Hudson <ghudson at mit.edu>
Date:   Thu Oct 22 19:31:01 2026 -0400

    Fix leak on krb5 gss_accept_sec_context() failure
    
    In kg_accept_krb5(), properly release deleg_cred when cleaning up
    after a failure.  Reported by Moritz Theile.
    
    [Backport note: kg_release_cred() does not exist in the krb5-1.22
    branch; awkwardly use krb5_gss_release_cred() instead.]
    
    (cherry picked from commit 2eaa2f0334808bf491fcaab005586bf1da29cf83)
    
    ticket: 9269
    version_fixed: 1.22.3

 src/lib/gssapi/krb5/accept_sec_context.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
index 3a7fb4e89..b88c2098a 100644
--- a/src/lib/gssapi/krb5/accept_sec_context.c
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
@@ -1161,12 +1161,9 @@ fail:
     if (ctx)
         (void) krb5_gss_delete_sec_context(&tmp_minor_status,
                                            (gss_ctx_id_t *) &ctx, NULL);
-    if (deleg_cred) { /* free memory associated with the deleg credential */
-        if (deleg_cred->ccache)
-            (void)krb5_cc_close(context, deleg_cred->ccache);
-        if (deleg_cred->name)
-            kg_release_name(context, &deleg_cred->name);
-        xfree(deleg_cred);
+    {
+        gss_cred_id_t dcred = (gss_cred_id_t) deleg_cred;
+        (void) krb5_gss_release_cred(&tmp_minor_status, &dcred);
     }
     if (token.value)
         xfree(token.value);