CVE-2026-71226

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

View on CVE.org
Published Aug 5, 2026 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Description
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

Analysis

AI-generated

Technical impact

Libkcapi’s one‑shot asynchronous I/O path can return an error before all posted I/O control blocks are drained, allowing subsequent kernel writes to overwrite caller‑owned output buffers. This uncontrolled memory corruption may result in crashes or, in scenarios where an attacker can influence the application, arbitrary code execution.

Affected Systems

Red Hat Enterprise Linux 8, 9, and 10; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 use libkcapi in user space. The vulnerability exists in the version of libkcapi bundled with these products as supplied by Red Ha​t.

Risk and Exploitability

The CVSS score of 7.3 indicates a medium‑to‑high severity. The EPSS score is not available and the CVE is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. Based on the description, the likely attack vector is an application that uses libkcapi’s AIO interface; an attacker could trigger the error condition to cause the kernel to write into a buffer that has been freed or reallocated, leading to loss of memory integrity.

Remediation

Vendor Workaround

To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory.

OpenCVE Recommended Actions

  • Modify the application to avoid initializing libkcapi with the KCAPI_INIT_AIO flag, preferring synchronous interfaces instead
  • If AIO must be enabled, ensure outbound I/O vectors are retained until the kernel signals completion and are not freely freed or reused immediately after an error return
  • Monitor Red Ha​t releases for a formal patch to libkcapi and apply it when available

Generated by OpenCVE AI on August 5, 2026 at 15:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:5 cpe:/a:redhat:openshift:5.0::el10
cpe:/a:redhat:openshift:5.0::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.22::el9
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
Redhat rhel Tus
CPEs cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/o:redhat:rhel_tus:8.8::baseos
Vendors & Products Redhat rhel E4s
Redhat rhel Tus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:5
Type Values Removed Values Added
First Time appeared Redhat rhel Eus
CPEs cpe:/o:redhat:rhel_eus:9.6::baseos
Vendors & Products Redhat rhel Eus
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:9		 cpe:/o:redhat:enterprise_linux:10.2
cpe:/o:redhat:enterprise_linux:9::baseos
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:8::baseos
References
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Smuellerdd
Smuellerdd libkcapi
CPEs cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:smuellerdd:libkcapi:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Smuellerdd
Smuellerdd libkcapi
Type Values Removed Values Added
First Time appeared Redhat hardened Images
Redhat openshift Container Platform
Vendors & Products Redhat hardened Images
Redhat openshift Container Platform
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
Title Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
First Time appeared Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
Weaknesses CWE-416
CPEs cpe:/a:redhat:hummingbird:1
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat hummingbird
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}
Earlier changes (9)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 9, 2026, 4:42 PM
Reserved
Aug 5, 2026, 9:15 AM

View source JSON

Updated
Aug 5, 2026, 1:36 PM

JSON

Status
Modified
Published
Aug 5, 2026, 1:24 PM
Modified
Nov 9, 2026, 5:17 PM

View source JSON

Severity
Moderate
Public date
Aug 5, 2026, 12:22 PM

View source Bugzilla JSON

Updated
Aug 7, 2026, 10:06 AM

JSON