CVE-2026-71225 Details

A vulnerability exists in libkcapi versions 1.5.0-3.el10 and in all minor update streams of Red Hat Enterprise Linux 8, 9, and 10, as well as in Red Hat Hardened Images. The issue arises during one-shot symmetric cipher operations on large inputs exceeding 64 KiB, when using stateful modes like Counter (CTR) or Cipher Block Chaining (CBC). The library incorrectly reuses the Initialization Vector (IV) for each internal data chunk, which could be exploited by a remote attacker to weaken data confidentiality by exposing relationships in encrypted plaintext. This flaw may also disrupt data integrity by causing incorrect cryptographic processing.

Until a fix is available, applications using libkcapi should avoid the one-shot symmetric cipher APIs for large inputs when continuous-message semantics are important. Instead, use the streaming interface for processing long messages or keep one-shot inputs below 64 KiB.