# CVE-2026-71226: Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Status: published. Published: 2026-08-05. Updated: 2026-11-02.

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

## Remediation

- workaround: To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory. (source: CNA: redhat)

## Affected products and versions

- Stephan Muelle / libkcapi: ≥ 0.12.0; < 1.5.1 (affected, semver). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (libkcapi): ≥ 0:1.5.1-1.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10.0 Extended Update Support (libkcapi): ≥ 0:1.5.0-6.el10_0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (libkcapi): ≥ 0:1.4.0-3.el8_10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service (libkcapi): ≥ 0:1.2.0-3.el8_8.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (libkcapi): ≥ 0:1.2.0-3.el8_8.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (libkcapi): ≥ 0:1.4.0-3.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.6 Extended Update Support (libkcapi): ≥ 0:1.4.0-2.el9_6.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (libkcapi-main): ≥ 1.5.1-0.1.hum1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.3 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.14% as of 2026-11-01; percentile 2.99%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-416

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:56985 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:67265 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:67266 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:67267 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:69285 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:87712 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:93453 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-71226 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2462114 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-71226; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-71226; retrieved 2026-11-02; source updated Not reported

Revision: a1c65f94566b259574a4cafaff40d2f53e9465f35e90853c5cae3c5d6e09f213

Canonical: https://y2.dev/cve/CVE-2026-71226