CVE-2026-71227
published 2026-08-05CVE-2026-71227: A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled…
PriorityP418medium5.1CVSS 3.1
AVLACHPRNUINSUCNINAH
EPSS
0.17%
5.4th percentile
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
| smuellerdd | libkcapi | >= 0.12.0 < 1.5.1 | 1.5.1 |
| stephan_muelle | libkcapi | >= 0.12.0 < 1.5.1 | 1.5.1 |
CVSS provenance
nvdv3.15.1MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
vendor_redhat·2026-08-05·CVSS 5.1
CVE-2026-71227 [MEDIUM] CWE-835 libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.
Mitigation: To mitigate this issue, applications should avoid initializing `libkcapi` handles with `KCAPI_INIT_AIO` if AIO functionality is not strictly required. If AIO must be used, applications should destroy and reinitialize `libkcapi` handles after any AIO completion error, rather than reusin
VulDB
Red Hat Enterprise Linux libkcapi _kcapi_aio_read_all infinite loop (Nessus ID 332248)
vuldb·2026-08-05·CVSS 5.1
CVE-2026-71227 [MEDIUM] Red Hat Enterprise Linux libkcapi _kcapi_aio_read_all infinite loop (Nessus ID 332248)
A vulnerability, which was classified as critical, was found in Red Hat Enterprise Linux. The impacted element is the function _kcapi_aio_read_all of the component libkcapi. Executing a manipulation can lead to infinite loop.
This vulnerability is handled as CVE-2026-71227. It is possible to launch the attack on the local host. There is not any exploit available.
GHSA
A flaw was found in libkcapi.
ghsa_unreviewed·2026-08-05
CVE-2026-71227 [MEDIUM] CWE-835 A flaw was found in libkcapi.
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-71227 libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return [fedora-all]
bugzilla·2026-08-05·CVSS 5.1
CVE-2026-71227 [MEDIUM] CVE-2026-71227 libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return [fedora-all]
CVE-2026-71227 libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: libkcapi-1.5.0-3.el10
Summary: Denial of Service via Infinite Loop in AIO Read on Timeout: reuse
of an AIO-enabled handle after a prior completion error can leave
`_kcapi_aio_read_all()` in a non-progress timeout loop and hang the caller
indefinitely.
Requirements to exploit: An attacker must be able to influence an
application that uses the AIO interface from `libkcapi-1.5.0-3.el10`,
initializes
Bugzilla
CVE-2026-71227 libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
bugzilla·2026-04-26·CVSS 5.1
CVE-2026-71227 [MEDIUM] CVE-2026-71227 libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
CVE-2026-71227 libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
AI_ONLY_REPORT
package: libkcapi-1.5.0-3.el10
Summary: Denial of Service via Infinite Loop in AIO Read on Timeout: reuse
of an AIO-enabled handle after a prior completion error can leave
`_kcapi_aio_read_all()` in a non-progress timeout loop and hang the caller
indefinitely.
Requirements to exploit: An attacker must be able to influence an
application that uses the AIO interface from `libkcapi-1.5.0-3.el10`,
initializes handles with `KCAPI_INIT_AIO`, triggers at least one AIO
completion error, and then reuses the same handle in a later AIO operation
so that `_kcapi_aio_read_iov()` waits for more completions than remain
outstanding.
Component affected: `
Wiz
CVE-2025-71227 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.5
CVE-2025-71227 [MEDIUM] CVE-2025-71227 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-71227 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't WARN for connections on invalid channels
It's not clear (to me) how exactly syzbot managed to hit this,
but it seems conceivable that e.g. regulatory changed and has
disabled a channel between scanning (channel is checked to be
usable by cfg80211_get_ies_channel_number) and connecting on
the channel later.
With one scenario that isn't covered elsewhere described above,
the warning isn't good, replace it with a (more informative)
error message.
Source : NVD
## 5.5
Score
Published February 18, 2026
Severity MEDIUM
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has CISA KEV Exploi
https://access.redhat.com/errata/RHSA-2026:56985https://access.redhat.com/errata/RHSA-2026:67265https://access.redhat.com/errata/RHSA-2026:67266https://access.redhat.com/errata/RHSA-2026:67267https://access.redhat.com/errata/RHSA-2026:69285https://access.redhat.com/errata/RHSA-2026:87712https://access.redhat.com/security/cve/CVE-2026-71227https://bugzilla.redhat.com/show_bug.cgi?id=2462867
2026-08-05
Published