Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
Affects libkcapi 0.12.0 through 1.5.1. Red Hat lists libkcapi-1.4.0-3.el9_8 as the fixed build for its Enterprise Linux products.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.5.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Stephan Muelle libkcapi
From 0.12.0 · fixed in 1.5.1
- libkcapi
Version range not reported
- libkcapi
Version range not reported
- libkcapi
Version range not reported
- libkcapi
Version range not reported
- libkcapi
Version range not reported
- libkcapi-main
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
References 8
Questions about CVE-2026-71226
What does this mean?
Memory corruption in libkcapi's one-shot AIO path happens when AIO requests are left uncanceled after an error.Source: access.redhat.com
Am I affected, and how do I check?
Upstream libkcapi versions from 0.12.0 up to but not including 1.5.1 are listed as affected. The installed version can be checked with the libkcapi tools or the package manager, for example rpm -q libkcapi on Red Hat systems.Source: access.redhat.com
What should I do about it?
Upgrade libkcapi to 1.5.1 or later upstream, or to libkcapi-1.4.0-3.el9_8 or later where Red Hat ships it.Source: access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data