CVE-2026-71226: Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-05 · updated 2026-10-30
Weakness: CWE-416

Description

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

Affected products

Red Hat Enterprise Linux: 8.0, 9.0, 10.0 (and their updates)
RedHat Hardened Images: all versions
Red Hat OpenShift Container Platform 4.18: 4.0 (and their updates)
smuellerDD Libkcapi: from 0.12.0 before 1.5.1 — fixed in 1.5.1
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Enterprise Linux 10: all versions — fixed in 0:1.5.1-1.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:1.5.0-6.el10_0
Red Hat Enterprise Linux 8: all versions — fixed in 0:1.4.0-3.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:1.4.0-3.el9_8
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:1.4.0-2.el9_6.1
Red Hat Hardened Images: all versions — fixed in 1.5.1-0.1.hum1
Red Hat OpenShift Container Platform 5: all versions
Stephan Muelle libkcapi: from 0.12.0 before 1.5.1 — fixed in 1.5.1

How to fix

Upgrade to a fixed version: smuellerDD Libkcapi 1.5.1; Red Hat Enterprise Linux 10 0:1.5.1-1.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.5.0-6.el10_0; Red Hat Enterprise Linux 8 0:1.4.0-3.el8_10; Red Hat Enterprise Linux 9 0:1.4.0-3.el9_8; Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.4.0-2.el9_6.1; Red Hat Hardened Images 1.5.1-0.1.hum1; Stephan Muelle libkcapi 1.5.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-71226 or the next vulnerability affects your stack