Hi,
The following vulnerabilities were published for libkcapi.
Only reference at time of writing were the Red Hat bugreports (see
security-tracker pages), can you check upstream if they are known and
tracked?
CVE-2026-71225[0]:
| A flaw was found in libkcapi. When performing one-shot symmetric
| cipher operations on large inputs (over 64 KiB) in stateful modes
| such as Counter (CTR) or Cipher Block Chaining (CBC), the library
| improperly reuses the Initialization Vector (IV) for each internal
| data chunk. A remote attacker could potentially exploit this by
| making an application that uses libkcapi process specially crafted
| large inputs. This can lead to a significant weakening of data
| confidentiality, as the repeated IV use can expose relationships in
| encrypted plaintext, and may also affect data integrity by causing
| incorrect cryptographic processing.
CVE-2026-71226[1]:
| Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's
| one-shot AIO path can return an error before all submitted IOCBs are
| drained, allowing later kernel writes into caller-owned output
| buffers.
CVE-2026-71227[2]:
| A flaw was found in libkcapi. A local attacker can influence an
| application that uses the Asynchronous Input/Output (AIO) interface.
| By reusing an AIO-enabled handle after a prior completion error, the
| _kcapi_aio_read_all() function can enter a non-terminating wait
| loop. This can lead to a persistent denial of service, making the
| affected application or thread unresponsive.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-71225
https://www.cve.org/CVERecord?id=CVE-2026-71225
[1] https://security-tracker.debian.org/tracker/CVE-2026-71226
https://www.cve.org/CVERecord?id=CVE-2026-71226
[2] https://security-tracker.debian.org/tracker/CVE-2026-71227
https://www.cve.org/CVERecord?id=CVE-2026-71227
Regards,
Salvatore