Skip to main content

libkcapi CVE-2026-71226

| EUVDEUVD-2026-53375 HIGH
Use After Free (CWE-416)
2026-08-05 redhat GHSA-rg4h-x337-qh8m
Buffer Overflow Use After Free Memory Corruption Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat Hardened Images Red Hat
7.3
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
HIGH
qualitative
NVD
7.3 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vuln.today AI
7.3 HIGH

Local-only AIO trigger requires no elevated privileges; crash impact dominates, with secondary low-severity buffer integrity and data exposure.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.8 MEDIUM
AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Red Hat
7.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 05, 2026 - 13:47 vuln.today
CVE Published
Aug 05, 2026 - 12:37 nvd
HIGH 7.3

DescriptionNVD

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

AnalysisAI

Memory corruption in libkcapi's one-shot asynchronous I/O path allows a local process to induce kernel writes into application-owned output buffers after an error return. Affected platforms include Red Hat Enterprise Linux 8, 9, and 10, Red Hat Hardened Images, and OpenShift Container Platform 4. An unprivileged local attacker or a compromised application can exploit this use-after-free-class condition to crash the calling process (high availability impact) or corrupt buffer contents for limited confidentiality and integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

libkcapi is a user-space interface library to the Linux kernel's AF_ALG crypto API socket interface, providing applications with access to kernel-accelerated cryptographic operations. The vulnerability exists in the 'one-shot' AIO (Asynchronous I/O) execution path: when submitting IOCBs (I/O Control Blocks) for async crypto operations, an error condition can cause the function to return prematurely before all submitted IOCBs are cancelled or drained. Because the kernel continues processing these undrained IOCBs, it subsequently writes results back into output buffers that have already been returned to - and potentially freed or reused by - the calling application. This is classified under CWE-416 (Use After Free), with secondary characteristics of buffer overflow and memory corruption, as the kernel write target is a caller-owned region whose lifetime the library no longer controls. The affected CPEs span the entire RHEL product line (8, 9, 10) as well as hardened image builds and OpenShift 4, indicating a broad library distribution across Red Hat's supported ecosystem.

RemediationAI

Apply the Red Hat-issued update for libkcapi through standard package management (dnf update libkcapi) once a patched package version is published to the relevant RHEL, OpenShift, or Hardened Image channels. Monitor the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-71226 and the upstream bug at https://bugzilla.redhat.com/show_bug.cgi?id=2462114 for confirmed fix version numbers, which were not independently verifiable from the available input data. As a compensating control where patching is not immediately possible, restrict access to applications that use libkcapi's AIO interface to trusted processes only - specifically, avoid exposing AIO-backed crypto paths to untrusted local users or container workloads. For OpenShift environments, enforce Security Context Constraints (SCC) to prevent untrusted pods from running workloads that invoke libkcapi AIO functions. Note that the local-only attack vector naturally limits the threat surface, so network-level controls do not address this vulnerability; isolation of the execution environment is the operative compensating measure.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-71226 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy