CVE-2026-71227
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A flaw in libkcapi allows a local attacker to influence an application using the AIO interface. Reusing an AIO-enabled handle after a prior completion error can cause _kcapi_aio_read_all() to enter a non-terminating wait loop, leading to persistent denial of service.
Risk Assessment
The attack can make the application or thread unresponsive, potentially disrupting critical services.
Recommendation
Update libkcapi to a patched version. Monitor applications using AIO for unusual behavior.
Other vulnerabilities in libkcapi
See all- CVE-2026-71226High
In libkcapi, the one-shot AIO path can return an error before all IOCBs are drained, allowing the kernel to later write into caller-owned output buffers, causing memory corruption.
- CVE-2026-71225Medium
In libkcapi, when performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes like CTR or CBC, the library improperly reuses the IV for each internal chunk. A remote attacker could exploit this, leading to weakened data confidentiality and potential integrity issues.
Original NVD description (English source)
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.