libkcapi vulnerabilities

A flaw in libkcapi allows a local attacker to influence an application using the AIO interface. Reusing an AIO-enabled handle after a prior completion error can cause _kcapi_aio_read_all() to enter a non-terminating wait loop, leading to persistent denial of service.

In libkcapi, the one-shot AIO path can return an error before all IOCBs are drained, allowing the kernel to later write into caller-owned output buffers, causing memory corruption.

In libkcapi, when performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes like CTR or CBC, the library improperly reuses the IV for each internal chunk. A remote attacker could exploit this, leading to weakened data confidentiality and potential integrity issues.