Moderate Security Vulnerability in libkcapi: IV Reuse and Memory Corruption Issues
Summary
RLSA-2026:67266: Moderate: libkcapi security update. Affects libkcapi versions < 0:1.4.0-3.el8_10. Fixed in 0:1.4.0-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libkcapi is a library that allows user-space applications to access the Linux kernel crypto API. It simplifies the use of the netlink interface, enabling developers to interact with cryptographic functions without delving into low-level details. However, its design allows unprivileged processes to access sensitive cryptographic operations, making it susceptible to security vulnerabilities.
Vulnerability Detail
The libkcapi library has several vulnerabilities that could lead to severe security issues. The first vulnerability (CVE-2026-71225) involves IV reuse in one-shot symmetric cipher chunking, which can reset the cipher state across chunk boundaries, potentially allowing attackers to decrypt sensitive information. The second vulnerability (CVE-2026-71226) is a memory corruption issue caused by uncanceled AIO requests on error in the one-shot AIO path, which could lead to application crashes or arbitrary code execution. Lastly, CVE-2026-71227 describes an infinite loop denial of service in the _kcapi_aio_read_all() function due to unhandled io_getevents() timeout returns, which could render the application unresponsive.
How To Fix
Minimum fixed version
0:1.4.0-3.el8_10
This is the first release that contains the fix.
sudo dnf update libkcapiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the libkcapi library for unprivileged users until the package can be updated. This can be done by modifying file permissions or using access control lists (ACLs) to limit who can execute the library.
Conclusion
The libkcapi library has been identified with several vulnerabilities that could compromise the security of applications relying on it. It is crucial to update to the patched version to mitigate these risks. Additionally, using tools like Vulert can help monitor for such vulnerabilities in your software.
See every vulnerability recorded for libkcapi →
FAQ
libkcapi is a library that provides user-space access to the Linux kernel crypto API, allowing developers to perform cryptographic operations without dealing with low-level netlink interfaces.
The main vulnerabilities include IV reuse in symmetric cipher chunking, memory corruption via uncanceled AIO requests, and an infinite loop denial of service due to unhandled timeout returns.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in software. By uploading your manifest file like package-lock.json to Vulert, you can check for vulnerabilities without needing to install any software.
The CVSS score for this vulnerability is 7.3, indicating a moderate severity level.
You can update libkcapi by running the command 'sudo yum update libkcapi' in your terminal, which will fetch the latest patched version from the repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for libkcapi.
