CVE-2026-71227
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Workarounds
To mitigate this issue, applications should avoid initializing libkcapi handles with KCAPI_INIT_AIO if AIO functionality is not strictly required. If AIO must be used, applications should destroy and reinitialize libkcapi handles after any AIO completion error, rather than reusing them for subsequent AIO operations.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://access.redhat.com/security/cve/CVE-2026-71227
- https://bugzilla.redhat.com/show_bug.cgi?id=2462867
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.