Y2
Public vulnerability disclosure

CVE-2026-71226

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

publishedCWE-416

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

Investigate in Cyber JSONMarkdown
Technical severity7.3 highCVSS 3.1 · CNA: redhat
Published2026-08-05Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
libkcapi
Stephan Muelle 		≥ 0.12.0; < 1.5.1 (affected, semver)
Other versions: unaffected 		CNA: redhat
Red Hat Enterprise Linux 10
Red Hat
libkcapi
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.5.1-1.el10_2; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat
libkcapi
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.5.0-6.el10_0; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8
Red Hat
libkcapi
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.4.0-3.el8_10; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat
libkcapi
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.2.0-3.el8_8.1; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat
libkcapi
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.2.0-3.el8_8.1; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9
Red Hat
libkcapi
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.4.0-3.el9_8; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat
libkcapi
https://access.redhat.com/downloads/content/package-browser/ 		≥ 0:1.4.0-2.el9_6.1; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat Hardened Images
Red Hat
libkcapi-main
https://catalog.redhat.com/software/containers/ 		≥ 1.5.1-0.1.hum1; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4
Red Hat
openshift/ose-rhel-coreos-8
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4
Red Hat
openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 5
Red Hat
openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 7.3
high		 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References