libkcapi EUVD-2026-53375

The vulnerability requires that the target application uses libkcapi's one-shot AIO code path specifically - standard synchronous crypto operations or non-AIO async paths are not implicated by the description. An attacker must be able to execute local code on the affected system (AV:L) or control a workload on an affected container host. No elevated privileges are required (PR:N per CVSS vector), meaning any unprivileged local user or container process can trigger the issue provided they can invoke the vulnerable AIO path. Exploitation is limited by: (1) the local attack vector - remote unauthenticated exploitation is not possible; (2) the requirement that the target process be using the specific one-shot AIO interface of libkcapi; and (3) timing dependency on the error condition occurring before IOCB drain completes, which introduces a race-like characteristic consistent with AC:L (reliably triggerable but still requires the error path to be hit).

The CVSS 3.1 base score of 7.3 with a local attack vector (AV:L) and no privilege requirement (PR:N) presents an interesting signal mix. The local attack vector limits internet-facing exposure, making this a lower priority than network-exploitable flaws of similar severity. However, the high availability impact (A:H) means a successful trigger can crash the affected process, which matters significantly in contexts where libkcapi backs cryptographic operations for sensitive workloads - including containerized environments on OpenShift. EPSS data was not provided in the input, so exploitation probability cannot be quantified. KEV status is not confirmed, and no POC exists per available data. The real-world risk is elevated for environments running untrusted local code alongside libkcapi-dependent services (e.g., containerized multi-tenant workloads), but lower for single-tenant or tightly controlled RHEL deployments. The integrity and confidentiality impacts (both Low) are secondary to the crash-class risk. This is a genuine remediation priority for Red Hat-based environments with multi-tenant or container workloads, but not an emergency for isolated deployments. No conflicting signals between CVSS vector and description were identified - local AIO is correctly modeled as AV:L.

A local user or malicious container running on an OpenShift node submits a crafted sequence of cryptographic operations through an application that calls libkcapi's one-shot AIO interface, then triggers an error condition mid-flight. The library returns an error to the caller before cancelling all outstanding IOCBs, and the kernel subsequently writes into the application's output buffers - which may already have been reallocated - causing memory corruption that crashes the process or, in more sophisticated exploitation, manipulates buffer contents. No public exploit code has been identified at time of analysis.