RHSA-2026:56985MediumCVSS 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
August 19, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (3)

CVE-2026-71225 →CVE-2026-71226 →CVE-2026-71227 →

📋 Description

CVE-2026-71225 — libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries CVE-2026-71226 — libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path CVE-2026-71227 — libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

🎯 Affected products4

  • Red Hat Hardened Images
  • libkcapi-main@aarch64 as a component of Red Hat Hardened Images
  • libkcapi-main@src as a component of Red Hat Hardened Images
  • libkcapi-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, applications using `libkcapi` should avoid the one-shot symmetric cipher APIs for inputs exceeding 64 KiB when continuous-message semantics are critical. Instead, prefer the streaming interface for processing large messages, or ensure one-shot inputs remain below the internal chunking threshold to guarantee the IV is applied consistently throughout the operation. Workaround: To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory. Workaround: To mitigate this issue, applications should avoid initializing `libkcapi` handles with `KCAPI_INIT_AIO` if AIO functionality is not strictly required. If AIO must be used, applications should destroy and reinitialize `libkcapi` handles after any AIO completion error, rather than reusing them for subsequent AIO operations.

🔗 References (7)