TI-2026-49900 CVE-2026-71226 · GHSA-rg4h-x337-qh8m
Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
Priority LOW 31
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.