CVE-2026-71226
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In libkcapi, the one-shot AIO path can return an error before all IOCBs are drained, allowing the kernel to later write into caller-owned output buffers, causing memory corruption.
Risk Assessment
Memory corruption can lead to application crashes or potentially arbitrary code execution in the context of the process using libkcapi.
Recommendation
Update libkcapi to a patched version and avoid using the one-shot AIO path in critical applications.
Other vulnerabilities in libkcapi
See all- CVE-2026-71227Medium
A flaw in libkcapi allows a local attacker to influence an application using the AIO interface. Reusing an AIO-enabled handle after a prior completion error can cause _kcapi_aio_read_all() to enter a non-terminating wait loop, leading to persistent denial of service.
- CVE-2026-71225Medium
In libkcapi, when performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes like CTR or CBC, the library improperly reuses the IV for each internal chunk. A remote attacker could exploit this, leading to weakened data confidentiality and potential integrity issues.
Original NVD description (English source)
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.