libkcapi CVE-2026-71225

Exploitation requires all of the following to be true simultaneously: (1) the target application must call libkcapi's one-shot symmetric cipher API (e.g., kcapi_cipher_enc or kcapi_cipher_dec) rather than a streaming/multi-call variant; (2) the input processed in a single one-shot call must exceed 64 KiB - inputs at or below this threshold are not chunked and are therefore not affected; (3) the cipher mode must be a stateful IV-dependent mode - specifically CTR (Counter) or CBC (Cipher Block Chaining); modes such as ECB or AEAD (GCM) are not described as affected. What limits exploitation: the attacker must be able to influence the content or size of inputs processed by the application AND observe ciphertext output or its downstream effects, which is application-architecture-dependent. Applications using streaming cipher APIs, inputs consistently under 64 KiB, or AEAD modes are not affected by this specific flaw.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) scores 6.5, appropriately reflecting that while the confidentiality impact is high and the attack is network-reachable with no required privileges, exploitation is constrained by high attack complexity. Real-world exploitation requires a precise confluence: (1) an application uses libkcapi's one-shot symmetric API, (2) it processes inputs exceeding 64 KiB in a single call, and (3) the chosen mode is CTR or CBC. The I:L rating for integrity is grounded in the description's note that incorrect chunk-boundary IV handling can cause incorrect cryptographic processing. No EPSS score was provided, and the CVE is absent from CISA KEV, with no reported POC. This is a meaningful cryptographic correctness flaw - not mass-exploitable, but a genuine risk for applications relying on libkcapi for confidential data transport, particularly those in regulated or high-assurance environments using RHEL or OpenShift. The combination of AC:H and the narrow applicability to one-shot API usage makes this lower operational priority than a CVSS 6.5 with AC:L would suggest.

An attacker controlling a large network payload processed by a server-side application using libkcapi's one-shot AES-CTR encryption - such as an encrypted file storage or VPN-adjacent service - submits a crafted input exceeding 64 KiB. Because libkcapi reuses the original counter value for each internal 64 KiB chunk, the attacker can XOR corresponding ciphertext blocks from successive chunks to cancel out plaintext, recovering relationships in the underlying data or, with known-plaintext, directly recovering encrypted content. No POC is publicly known at time of analysis.