CVE-2026-71225: 
NixOS vulnerability analysis and mitigation

CVE-2026-71225 is a cryptographic flaw in libkcapi where the library improperly reuses the Initialization Vector (IV) for each internal data chunk when performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC). Discovered by AISLE Research in partnership with Red Hat and disclosed on August 5, 2026, the vulnerability affects libkcapi versions 0.10.1 through 1.5.0 (fixed in 1.5.1), as well as Red Hat Enterprise Linux 8, 9, and 10, OpenShift Container Platform 4.0, and Red Hat Hardened Images. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-330 (Use of Insufficiently Random Values), specifically the improper reuse of a caller-provided IV across internal chunk boundaries. In the one-shot symmetric cipher path (kcapi_cipher_encrypt / kcapi_cipher_decrypt), the function _kcapi_cipher_crypt_chunk() splits inputs larger than sysconf(_SC_PAGESIZE) * ALG_MAX_PAGES (typically 64 KiB) into multiple chunks and calls _kcapi_cipher_crypt() for each. Each call invokes _kcapi_common_send_meta(), which copies handle->cipher.iv into ALG_SET_IV every time — effectively restarting the cipher state at each chunk boundary rather than continuing the operation as a single message. For CTR mode, this restarts the keystream at each 64 KiB boundary, exposing plaintext relationships; for CBC mode, the chaining value is reset, breaking continuous-message semantics. Exploitation requires an attacker to control or influence a network-facing application that uses libkcapi's one-shot API with inputs exceeding the chunking threshold in an affected cipher mode (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation leads to a significant weakening of data confidentiality: in CTR mode, the keystream restarts at each 64 KiB chunk boundary, allowing an attacker who can observe ciphertext to detect relationships between plaintext blocks encrypted at corresponding offsets across chunks. In CBC mode, the chaining value reset causes large one-shot operations to produce output inconsistent with a true continuous-message CBC encryption, potentially affecting data integrity expectations in applications relying on correct cryptographic semantics. There is no direct availability impact, and exploitation is scoped to the vulnerable cryptographic operation without crossing additional security boundaries (Red Hat Bugzilla, Red Hat Advisory).

A proof-of-concept with concrete reproduction steps is publicly available via the Red Hat Bugzilla report, demonstrating the IV reuse by comparing one-shot and streaming API outputs on 128 KiB inputs. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.24%, reflecting a low near-term exploitation probability. Exploitation requires high attack complexity — the attacker must be able to cause a target application to invoke the one-shot API on inputs exceeding 64 KiB in an affected cipher mode and observe the resulting ciphertext (Red Hat Bugzilla, Github Advisory).

1. Identify a target application: Locate a network-facing application that uses libkcapi's one-shot symmetric cipher APIs (kcapi_cipher_encrypt or kcapi_cipher_decrypt) with CTR or CBC mode and processes attacker-influenced data larger than 64 KiB.
2. Craft large input: Prepare a plaintext buffer of at least 131,072 bytes (128 KiB), ensuring that a plaintext block at offset 0 is identical to the block at offset 65,536 to make keystream reuse detectable.
3. Trigger one-shot encryption: Cause the target application to encrypt the crafted buffer using kcapi_cipher_encrypt() with a fixed IV in ctr(aes) mode.
4. Observe ciphertext output: Collect the resulting ciphertext. Due to IV reuse at the 64 KiB chunk boundary, out_oneshot[0:16] will equal out_oneshot[65536:65552] when the corresponding plaintext blocks are identical — confirming keystream restart.
5. Exploit plaintext relationships: Use the repeated keystream segments to deduce relationships between plaintext blocks, or perform known-plaintext attacks to recover plaintext content from other ciphertext blocks encrypted with the same keystream segment.
6. Repeat for CBC: For CBC mode, observe that the one-shot output diverges from a continuous-stream CBC result at the chunk boundary, potentially enabling integrity bypass in applications that rely on correct CBC chaining (Red Hat Bugzilla).

Upgrade libkcapi to version 1.5.1 or later, which fixes the IV reuse by sending operation metadata and IV only for the first internal chunk and preserving cipher state across subsequent chunks. For Red Hat systems, apply available security updates for RHEL 8, RHEL 9, RHEL 10, OpenShift Container Platform 4.0, and Hardened Images. As an immediate workaround, applications using libkcapi should avoid the one-shot symmetric cipher APIs (kcapi_cipher_encrypt / kcapi_cipher_decrypt) for inputs exceeding sysconf(_SC_PAGESIZE) * ALG_MAX_PAGES (typically 64 KiB) when continuous-message semantics are required; instead, use the streaming interface (kcapi_cipher_stream_init_enc, kcapi_cipher_stream_update, kcapi_cipher_stream_op) for large messages (Red Hat Advisory, Red Hat Bugzilla).

Red Hat, as the CNA for this vulnerability, published the advisory and Bugzilla report on August 5, 2026, crediting AISLE Research for discovery in partnership with Red Hat. The vulnerability was picked up by standard vulnerability aggregators (VulnDB, Vulners, CVEFeed) shortly after disclosure, but no notable independent researcher commentary or significant social media discussion has been identified beyond routine aggregation (Red Hat Advisory).