Security Update for libkcapi: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:67266: Moderate: libkcapi security update. Affects libkcapi versions < 1.4.0-3.el8_10. Fixed in 1.4.0-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libkcapi is a library that enables user-space applications to access the Linux kernel crypto API. It simplifies the use of the netlink interface, allowing developers to interact with cryptographic functions without needing to manage low-level details. However, its design allows unprivileged processes to access potentially sensitive operations, making it susceptible to security vulnerabilities.
Vulnerability Detail
The vulnerabilities in libkcapi stem from improper handling of cryptographic operations and asynchronous I/O requests. Specifically, there are issues with IV reuse in one-shot symmetric cipher chunking (CVE-2026-71225), which can lead to cipher state resets across chunk boundaries. Additionally, memory corruption can occur due to uncanceled AIO requests on errors (CVE-2026-71226), and an infinite loop denial of service can be triggered by unhandled timeout returns in the AIO read function (CVE-2026-71227). These vulnerabilities can lead to severe security risks, including data leakage and denial of service.
How To Fix
Minimum fixed version
1.4.0-3.el8_10
This is the first release that contains the fix.
sudo dnf update libkcapiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the libkcapi library for unprivileged users until the update can be applied. This can be done by modifying file permissions or using access control lists (ACLs) to limit usage.
Conclusion
The vulnerabilities in libkcapi present significant security risks that can be mitigated through timely updates. Users are encouraged to apply the necessary patches and consider temporary workarounds to protect their systems until updates can be fully implemented.
See every vulnerability recorded for libkcapi →
FAQ
libkcapi is a library that provides user-space access to the Linux kernel crypto API, allowing developers to perform cryptographic operations without dealing with low-level details.
The main vulnerabilities include IV reuse in cipher operations, memory corruption from uncanceled AIO requests, and an infinite loop denial of service due to unhandled timeouts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If an immediate update is not possible, consider implementing access restrictions to the library for unprivileged users as a temporary workaround.
For more details, refer to the CVE pages associated with the vulnerabilities: CVE-2026-71225, CVE-2026-71226, and CVE-2026-71227.
Related vulnerabilities
Recent vulnerabilities recorded for libkcapi.
