CVE-2026-71226
published 2026-08-05CVE-2026-71226: Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later…
PriorityP335high7.3CVSS 3.1
AVLACLPRNUINSUCLILAH
EPSS
0.18%
7.3th percentile
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
| smuellerdd | libkcapi | >= 0.12.0 < 1.5.1 | 1.5.1 |
| stephan_muelle | libkcapi | >= 0.12.0 < 1.5.1 | 1.5.1 |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
vendor_redhat·2026-08-05·CVSS 7.3
CVE-2026-71226 [HIGH] CWE-416 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
Statement: This Moderate impact flaw in libkcapi affects applications utilizing the one-shot Asynchronous I/O (AIO) interfaces with the `KCAPI_INIT_AIO` flag. Exploitation requires an error to occur after submitting I/O Control Blocks (IOCBs), followed by the application freeing or reusing output buffers before all kernel completions are processed. This vulnerability does not affect default configurations as it relies on an opt-in AIO setup.
Mitigation: To mitigate this issue, applicatio
GHSA
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output b
ghsa_unreviewed·2026-08-05
CVE-2026-71226 [HIGH] CWE-416 Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output b
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71226 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path [fedora-all]
bugzilla·2026-08-05·CVSS 7.3
CVE-2026-71226 [HIGH] CVE-2026-71226 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path [fedora-all]
CVE-2026-71226 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: libkcapi-1.5.0-3.el10
Summary: Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's
one-shot AIO path can return an error before all submitted IOCBs are
drained, allowing later kernel writes into caller-owned output buffers.
Requirements to exploit: A consumer must use the one-shot AIO interfaces
with `KCAPI_INIT_AIO` so the real AIO backend is active, hit an error after
one or more IOCBs have been submitted
Bugzilla
CVE-2026-71226 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
bugzilla·2026-04-26·CVSS 7.3
CVE-2026-71226 [HIGH] CVE-2026-71226 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
CVE-2026-71226 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
AI_ONLY_REPORT
package: libkcapi-1.5.0-3.el10
Summary: Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's
one-shot AIO path can return an error before all submitted IOCBs are
drained, allowing later kernel writes into caller-owned output buffers.
Requirements to exploit: A consumer must use the one-shot AIO interfaces
with `KCAPI_INIT_AIO` so the real AIO backend is active, hit an error after
one or more IOCBs have been submitted or completed, and then free or reuse
the referenced `outiov` buffers before all kernel completions finish.
Component affected: `libkcapi-1.5.0-3.el10`, `lib/kcapi-kernel-if.c`,
`_kcapi_aio_read_all()`, `_kcapi_aio_read_iov()`,
`_kcapi_ci
https://access.redhat.com/errata/RHSA-2026:56985https://access.redhat.com/errata/RHSA-2026:67265https://access.redhat.com/errata/RHSA-2026:67266https://access.redhat.com/errata/RHSA-2026:67267https://access.redhat.com/errata/RHSA-2026:69285https://access.redhat.com/errata/RHSA-2026:87712https://access.redhat.com/security/cve/CVE-2026-71226https://bugzilla.redhat.com/show_bug.cgi?id=2462114
2026-08-05
Published