CVE-2026-71226

EUVD-2026-53375
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 3.35%
Affected Products (NVD)
VendorProductVersion
redhathardened_images
-
redhatopenshift_container_platform
4.0
smuellerddlibkcapi
0.12.0 ≤
𝑥
< 1.5.1
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
redhatenterprise_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libkcapi
bookworm
postponed
forky
vulnerable
sid
1.5.1-1
fixed
trixie
postponed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libkcapi
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
xenial
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libkcapi
RHEL 8
0:1.4.0-3.el8_10
fixed
RHEL 9
0:1.4.0-3.el9_8
fixed
libkcapi-hmaccalc
RHEL 8
0:1.4.0-3.el8_10
fixed
RHEL 9
0:1.4.0-3.el9_8
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
libkcapi
Azure Linux 3.0
0:1.5.1-1.azl3
fixed