Red Hat Security Advisory

RHSA-2026:67265

libkcapi security, bug fix, and enhancement update

Released 2026-09-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 9) libkcapi-1.4.0-3.el9_8, libkcapi-hmaccalc-1.4.0-3.el9_8

Fixes 3 records

TI-2026-49900 CVE-2026-71226 · GHSA-rg4h-x337-qh8m

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

LOW 31

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

CVSS 3.1HIGH 7.3 Local No auth No interaction EPSS 0.00147 Published 2026-08-05 Partial fix · 1.5.1, 1.5.1-1.el10_2 +7 CWE-416

TI-2026-49899 CVE-2026-71225 · GHSA-qv62-qmw8-96h9

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

LOW 29

A flaw was found in libkcapi.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00345 Published 2026-08-05 Partial fix · 1.5.1, 1.5.1-1.el10_2 +5 CWE-330

TI-2026-49901 CVE-2026-71227 · GHSA-c5mv-c5vm-62w5

Infinite loop in Stephan Muelle libkcapi

LOW 23

A flaw was found in libkcapi.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00197 Published 2026-08-05 Partial fix · 1.5.1, 1.5.1-1.el10_2 +5 CWE-835