CVE-2026-71227 Details

A denial-of-service vulnerability has been identified in libkcapi versions 1.5.0-3.el10, 1.5.0-3.el8, and 1.5.0-3.el9, as well as in Red Hat Hardened Images and Red Hat OpenShift Container Platform 4. This vulnerability allows a local attacker to cause an application that uses the Asynchronous Input/Output (AIO) interface to become unresponsive. The issue arises when an AIO-enabled handle is reused after a completion error, leading the _kcapi_aio_read_all() function into a non-terminating wait loop. As a result, the affected application or thread can experience a persistent denial-of-service condition.

Applications should avoid using the AIO interface with libkcapi unless absolutely necessary. If AIO must be used, handles should be destroyed and reinitialized after any completion error, rather than reusing them. For deployments that do not require AIO, handles should not be initialized with KCAPI_INIT_AIO.