CVE-2026-71227

EUVD-2026-53337
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.1 MEDIUM
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.22%
Affected Products (NVD)
VendorProductVersion
redhathardened_images
-
redhatopenshift_container_platform
4.0
smuellerddlibkcapi
0.12.0 ≤
𝑥
< 1.5.1
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
redhatenterprise_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libkcapi
bookworm
postponed
forky
vulnerable
sid
1.5.1-1
fixed
trixie
postponed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libkcapi
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
xenial
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libkcapi
RHEL 8
0:1.4.0-3.el8_10
fixed
RHEL 9
0:1.4.0-3.el9_8
fixed
libkcapi-hmaccalc
RHEL 8
0:1.4.0-3.el8_10
fixed
RHEL 9
0:1.4.0-3.el9_8
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
libkcapi
Azure Linux 3.0
0:1.5.1-1.azl3
fixed