CVE-2026-71226 PUBLISHED

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Assigner: redhat
Reserved: 05.08.2026 Published: 05.08.2026 Updated: 05.08.2026

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS Score: 7.3

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Hardened Images
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected

Workarounds

To mitigate this issue, applications should avoid initializing libkcapi handles with the KCAPI_INIT_AIO flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that outiov buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory.

Credits

  • This issue was discovered by Found by AISLE in partnership with Red Hat.

References

Problem Types

  • Use After Free CWE