CVE-2026-71226
Received Received - Intake

Memory Corruption in libkcapi via Uncanceled AIO Requests

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Red Hat, Inc.

Description
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71226
EUVD
EUVD-2026-53375

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat libkcapi 1.5.0-3.el10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves memory corruption in libkcapi's one-shot AIO path. When an error occurs after submitting AIO requests, the kernel may continue writing to output buffers that the application has already freed or reused, leading to potential data corruption or crashes.

Detection Guidance

Detecting this vulnerability requires checking for applications using libkcapi's one-shot AIO interfaces with KCAPI_INIT_AIO. Monitor for errors in AIO operations followed by buffer reuse or freeing. Check logs for heap corruption or use-after-free errors in applications using libkcapi.

Impact Analysis

An attacker could exploit this to cause denial of service, data corruption, or potentially execute arbitrary code on affected systems. It requires an error condition after AIO submission and buffer reuse, making it harder to trigger but still dangerous.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory corruption, which may lead to unauthorized data access or modification. Such conditions could violate data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Avoid initializing affected handles with KCAPI_INIT_AIO. Prefer synchronous interfaces over AIO. If AIO is required, do not free or reuse outiov buffers immediately after an error. Ensure all submitted requests are drained before returning errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart