CVE-2026-71226: Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• redhat enterprise linux10.0
• redhat enterprise linux8.0
• redhat enterprise linux9.0
• redhat hardened imagesall versions
• redhat openshift container platform4.0
• smuellerdd libkcapi0.12.0 and later · before 1.5.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Enterprise Linux 10

  • 0:1.5.1-1.el10_2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

  • 0:1.5.0-6.el10_0 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8

  • 0:1.4.0-3.el8_10 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • 0:1.2.0-3.el8_8.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • 0:1.2.0-3.el8_8.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 9

  • 0:1.4.0-3.el9_8 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support

  • 0:1.4.0-2.el9_6.1 and laternot affected · rpm

• Red Hat Red Hat Hardened Images

  • 1.5.1-0.1.hum1 and laternot affected · rpm

• Red Hat Red Hat OpenShift Container Platform 4

  • all versionsaffected

• Red Hat Red Hat OpenShift Container Platform 4.22

  • 4.22.9.8.202611032353-0 and laternot affected · rpm

• Red Hat Red Hat OpenShift Container Platform 5

  • all versionsaffected

• Stephan Muelle libkcapi

  • 0.12.0 and later · before 1.5.1affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-71225Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
  26Monitor
• CVE-2026-13757P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
  24Monitor
• CVE-2026-0990Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing
  23Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-2625Apr 3, 2026 · Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification
  22Monitor
• ← EarlierCVE-2026-13595Jun 29, 2026 · Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
  21Monitor
• Later →CVE-2026-71227Aug 5, 2026 · Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
  20Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.