Security Flaw in libkcapi: IV Reuse and Memory Corruption Vulnerabilities
Summary
ALSA-2026:67267: Moderate: libkcapi security, bug fix, and enhancement update. Affects libkcapi versions < 1.5.1-1.el10_2. Fixed in 1.5.1-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libkcapi is a library that allows user-space applications to access the Linux kernel crypto API. It simplifies the interaction with the kernel by providing easy-to-use APIs, eliminating the need for developers to manage low-level netlink interface handling. However, this library does not implement any cipher algorithms itself; instead, it relies on the kernel to process all consumer requests. This design allows unprivileged processes to utilize the library, which can lead to security vulnerabilities if not properly managed.
Vulnerability Detail
The vulnerabilities in libkcapi stem from multiple issues, including IV reuse in one-shot symmetric cipher chunking, which can reset the cipher state across chunk boundaries (CVE-2026-71225). Additionally, there is a risk of memory corruption due to uncanceled AIO requests when errors occur in the one-shot AIO path (CVE-2026-71226). Lastly, an infinite loop denial of service can occur in the function _kcapi_aio_read_all() if the io_getevents() timeout return is unhandled (CVE-2026-71227). These vulnerabilities can lead to severe security risks, including unauthorized access to sensitive data and denial of service.
How To Fix
Minimum fixed version
1.5.1-1.el10_2
This is the first release that contains the fix.
sudo dnf update libkcapiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the libkcapi library to only trusted applications and users until the package can be updated. Additionally, monitor the application for any unusual behavior that may indicate exploitation of these vulnerabilities.
Conclusion
The vulnerabilities in libkcapi present significant security risks that can lead to unauthorized access and denial of service. It is crucial to update to the patched version as soon as possible and implement temporary workarounds to mitigate risks until the update can be applied.
See every vulnerability recorded for libkcapi →
FAQ
libkcapi is a library that provides user-space access to the Linux kernel crypto API, allowing developers to utilize cryptographic functions without dealing with low-level details.
The main vulnerabilities include IV reuse in symmetric cipher chunking, memory corruption from uncanceled AIO requests, and an infinite loop denial of service due to unhandled timeouts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file, like package-lock.json, to check for vulnerabilities.
If an immediate update is not possible, restrict access to the library and monitor for any suspicious activity as a temporary measure.
For detailed information, refer to the CVE pages associated with the vulnerabilities: CVE-2026-71225, CVE-2026-71226, and CVE-2026-71227.
Related vulnerabilities
Recent vulnerabilities recorded for libkcapi.
