CVE-2026-71227

A flaw in libkcapi, the user-space library for the Linux kernel crypto API, lets a local attacker hang an application that uses its Asynchronous Input/Output (AIO) interface. When an AIO-enabled handle is reused after a prior completion error, the internal _kcapi_aio_read_all() routine enters a non-terminating wait loop, leaving the calling application or thread permanently unresponsive. The attacker gains a persistent denial of service only - no code execution or data exposure - consistent with the CVSS 5.1 score (local vector, high attack complexity, availability-only impact, CWE-835). Exposure includes the library as shipped in Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, and Red Hat hardened images, plus upstream libkcapi builds, though in practice only applications that actually use libkcapi's AIO APIs are reachable. There is no evidence of in-the-wild exploitation (not in CISA KEV; EPSS ~0.2%), but a public proof-of-concept is referenced in Red Hat Bugzilla #2462867.

What to do: Track Red Hat security errata for CVE-2026-71227 and update the libkcapi package (and dependent base images, including OpenShift node images) when a fixed version is published. In the interim, audit whether any local applications on your hosts call libkcapi's AIO APIs (kcapi_aio_*), and if so, avoid reusing AIO-enabled handles after a completion error and be prepared to restart hung processes. Because the flaw requires local access and high attack complexity, prioritize patching multi-tenant systems where untrusted local users exist.