Libkcapi’s one‑shot asynchronous I/O path can return an error before all posted I/O control blocks are drained, allowing subsequent kernel writes to overwrite caller‑owned output buffers. This uncontrolled memory corruption may result in crashes or, in scenarios where an attacker can influence the application, arbitrary code execution.

Red Hat Enterprise Linux 8, 9, and 10; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 use libkcapi in user space. The vulnerability exists in the version of libkcapi bundled with these products as supplied by Red Ha​t.

The CVSS score of 7.3 indicates a medium‑to‑high severity. The EPSS score is not available and the CVE is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. Based on the description, the likely attack vector is an application that uses libkcapi’s AIO interface; an attacker could trigger the error condition to cause the kernel to write into a buffer that has been freed or reallocated, leading to loss of memory integrity.