high 7.3

CVE-2026-71226 json

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

published 2026-08-05 3 mo ago modified 2026-11-06 2 d ago also EUVD-2026-53375

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits: 0; none known

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

Patch / fix

fixed in 10 distros 6

Stephan Muelle libkcapi 1.5.1
Red Hat Red Hat Enterprise Linux 10 0:1.5.1-1.el10_2
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.5.0-6.el10_0
Red Hat Red Hat Enterprise Linux 8 0:1.4.0-3.el8_10
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:1.2.0-3.el8_8.1
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:1.2.0-3.el8_8.1
Red Hat Red Hat Enterprise Linux 9 0:1.4.0-3.el9_8
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.4.0-2.el9_6.1
Red Hat Red Hat OpenShift Container Platform 4.22 4.22.9.8.202611032353-0
Red Hat Red Hat Hardened Images 1.5.1-0.1.hum1

debian red hat almalinux rocky linux alpine azure linux

libkcapi Debian 14 1.5.1-1

debian advisories DEBIAN-CVE-2026-71226

libkcapi RHEL 8 1.4.0-3.el8_10
libkcapi-hmaccalc RHEL 8 1.4.0-3.el8_10
libkcapi RHEL 10.2 1.5.1-1.el10_2
libkcapi-hasher RHEL 10.2 1.5.1-1.el10_2
libkcapi-hmaccalc RHEL 10.2 1.5.1-1.el10_2
libkcapi RHEL 9 1.4.0-3.el9_8
libkcapi-hmaccalc RHEL 9 1.4.0-3.el9_8
libkcapi hummingbird 1 1.5.1-0.1.hum1

red hat advisories RHSA-2026:69285 RHSA-2026:67266 RHSA-2026:67267 RHSA-2026:67265 RHSA-2026:56985

libkcapi AlmaLinux 9 1.4.0-3.el9_8
libkcapi-hmaccalc AlmaLinux 9 1.4.0-3.el9_8
libkcapi AlmaLinux 8 1.4.0-3.el8_10
libkcapi-hmaccalc AlmaLinux 8 1.4.0-3.el8_10
libkcapi AlmaLinux 10 1.5.1-1.el10_2
libkcapi-hasher AlmaLinux 10 1.5.1-1.el10_2
libkcapi-hmaccalc AlmaLinux 10 1.5.1-1.el10_2

almalinux advisories ALSA-2026:67265 ALSA-2026:67266 ALSA-2026:67267

libkcapi Rocky Linux 9 1.4.0-3.el9_8
libkcapi Rocky Linux 10 1.5.1-1.el10_2
libkcapi Rocky Linux 8 1.4.0-3.el8_10

rocky linux advisories RLSA-2026:67265 RLSA-2026:67267 RLSA-2026:67266

libkcapi Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.5.1-r0

alpine advisories ALPINE-CVE-2026-71226

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

libkcapi Azure Linux 3.0 1.5.1-1

azure linux advisories AZL-94658

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-71226 updated 2026-11-06 cvss 7.3

libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path

Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
affected: workaround, no fix available
Red Hat Enterprise Linux BaseOS (v. 8) libkcapi 1.4.0-3.el8_10, libkcapi-hmaccalc 1.4.0-3.el8_10
fixed: vendor fix RHSA-2026:67266
Red Hat Enterprise Linux BaseOS (v. 9) libkcapi 1.4.0-3.el9_8, libkcapi-hmaccalc 1.4.0-3.el9_8
fixed: vendor fix RHSA-2026:67265
Red Hat Enterprise Linux BaseOS (v. 10) libkcapi 1.5.1-1.el10_2, libkcapi-hasher 1.5.1-1.el10_2, libkcapi-hmaccalc 1.5.1-1.el10_2
fixed: vendor fix RHSA-2026:67267
Red Hat Enterprise Linux BaseOS E4S (v.8.8) libkcapi 1.2.0-3.el8_8.1
fixed: vendor fix RHSA-2026:93453
Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libkcapi 1.5.0-6.el10_0
fixed: vendor fix RHSA-2026:69285
Red Hat Enterprise Linux BaseOS EUS (v.9.6) libkcapi 1.4.0-2.el9_6.1, libkcapi-hmaccalc 1.4.0-2.el9_6.1
fixed: vendor fix RHSA-2026:87712
Red Hat Enterprise Linux BaseOS TUS (v.8.8) libkcapi 1.2.0-3.el8_8.1
fixed: vendor fix RHSA-2026:93453

show 3 more

Red Hat Hardened Images libkcapi 1.5.1-0.1.hum1, libkcapi-tests 1.5.1-0.1.hum1, libkcapi-tools 1.5.1-0.1.hum1, libkcapi-hasher 1.5.1-0.1.hum1, libkcapi-hmaccalc 1.5.1-0.1.hum1, libkcapi-fipscheck 1.5.1-0.1.hum1
fixed: vendor fix RHSA-2026:56985
Red Hat OpenShift Container Platform 4.22 rhcos 4.22.9.8.202611032353
fixed: vendor fix RHSA-2026:95346
Red Hat Enterprise Linux BaseOS E4S (v.8.8) libkcapi-hmaccalc 1.2.0-3.el8_8.1 Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libkcapi-hasher 1.5.0-6.el10_0, libkcapi-hmaccalc 1.5.0-6.el10_0 Red Hat Enterprise Linux BaseOS EUS (v.9.6) libkcapi-tests-debuginfo 1.4.0-2.el9_6.1, libkcapi-tools-debuginfo 1.4.0-2.el9_6.1, libkcapi-hmaccalc-debuginfo 1.4.0-2.el9_6.1, libkcapi-fipscheck-debuginfo 1.4.0-2.el9_6.1 Red Hat Enterprise Linux BaseOS TUS (v.8.8) libkcapi-hmaccalc 1.2.0-3.el8_8.1
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-08-05)

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
NVD	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

Stephan Muelle libkcapi
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat Red Hat OpenShift Container Platform 4.22
Red Hat Red Hat Hardened Images
Red Hat Red Hat OpenShift Container Platform 4
Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness

CWE-416 Use After Free

References

access.redhat.com /errata/RHSA-2026:56985
vendor-advisory
access.redhat.com /errata/RHSA-2026:67265
vendor-advisory
access.redhat.com /errata/RHSA-2026:67266
vendor-advisory
access.redhat.com /errata/RHSA-2026:67267
vendor-advisory
access.redhat.com /errata/RHSA-2026:69285
vendor-advisory
access.redhat.com /errata/RHSA-2026:87712
vendor-advisory
access.redhat.com /errata/RHSA-2026:93453
vendor-advisory
access.redhat.com /errata/RHSA-2026:95346
vendor-advisory
access.redhat.com /security/cve/CVE-2026-71226
vdb-entry, vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=2462114
issue-tracking, vendor-advisory

Sources

CVE List CVE-2026-71226
NVD CVE-2026-71226

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary