CVE-2026-71226: 
NixOS vulnerability analysis and mitigation

CVE-2026-71226 is a memory corruption vulnerability in libkcapi caused by uncanceled Asynchronous I/O (AIO) requests on error conditions. When libkcapi's one-shot AIO path returns an error before all submitted I/O Control Blocks (IOCBs) are drained, the kernel may subsequently write into caller-owned output buffers that have already been freed or reused, resulting in a use-after-free condition (CWE-416). It affects libkcapi versions 0.12.0 through 1.5.0 (fixed in 1.5.1), as well as Red Hat Enterprise Linux 8, 9, and 10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images. Disclosed on August 5, 2026, it carries a CVSS v3.1 base score of 7.3 (High) (Red Hat CVE, GitHub Advisory).

The root cause is a use-after-free (CWE-416) in libkcapi's one-shot AIO path, specifically in the functions _kcapi_aio_read_all(), _kcapi_aio_read_iov(), and _kcapi_cipher_crypt_aio() within lib/kcapi-kernel-if.c. In _kcapi_aio_read_all(), the function returns immediately upon encountering the first negative completion event without draining remaining submitted IOCBs; similarly, _kcapi_aio_read_iov() returns immediately on a short io_submit() result even if some IOCBs were already submitted to the kernel. If the calling application then frees or reuses the outiov buffers after receiving the error return, delayed kernel completions may still write into those now-freed or reallocated memory regions. Exploitation requires the application to have initialized the libkcapi handle with the KCAPI_INIT_AIO flag (an opt-in, non-default configuration), to encounter an error after IOCB submission, and to promptly free or reuse output buffers — making this a local, configuration-dependent attack vector (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can result in heap corruption, process termination, or in more severe cases, unauthorized code execution within the affected process's security scope. The primary impact is high availability loss due to process crashes from heap corruption, with secondary low-level confidentiality and integrity impacts — late kernel writes into reused buffers can expose limited process memory or alter caller data after a reported failure. The vulnerability is scoped to the local process using libkcapi and does not present a direct remote compromise scenario or straightforward lateral movement path (Red Hat CVE, Red Hat Bugzilla).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-71226. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.12% (2nd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It was discovered by Aisle Research in partnership with Red Hat and is rated Moderate impact by Red Hat due to its dependency on an opt-in AIO configuration and a specific error-path trigger (Red Hat CVE, GitHub Advisory).

1. Identify target application: Locate an application that uses libkcapi (versions 0.12.0–1.5.0) and initializes handles with the KCAPI_INIT_AIO flag, enabling the real kernel AIO backend.
2. Set up AIO harness: Build or instrument a test harness that calls kcapi_cipher_encrypt_aio() or kcapi_aead_decrypt_aio() with multiple output iovec entries.
3. Trigger short-submit or error path: Use an LD_PRELOAD wrapper around syscall(__NR_io_submit, ...) to return a partial submission count (0 < ret < iovlen), or fault-inject io_getevents() so that one returned event has res < 0 before all completions are consumed.
4. Free or reuse output buffers: Immediately after the API returns an error, free or reallocate the outiov[*].iov_base buffers in the calling application.
5. Observe memory corruption: Delayed kernel completions write into the freed or reallocated memory, observable as an ASAN use-after-free report, heap corruption, or canary mismatch in instrumented builds (Red Hat Bugzilla).

• Process Behavior: Unexpected crashes or termination of processes using libkcapi, particularly those initialized with KCAPI_INIT_AIO; ASAN or heap sanitizer reports indicating use-after-free in _kcapi_aio_read_all(), _kcapi_aio_read_iov(), or _kcapi_cipher_crypt_aio().
• Logs: Application crash logs or core dumps referencing libkcapi AIO functions; kernel AIO-related error messages (e.g., io_read Error) in application logs.
• File System: Presence of core dump files from processes using libkcapi with AIO enabled; memory sanitizer output files indicating heap corruption in libkcapi-linked binaries.

The upstream fix is available in libkcapi version 1.5.1, which drains all submitted IOCBs before returning an error rather than returning immediately. As a configuration-based workaround, applications should avoid initializing libkcapi handles with the KCAPI_INIT_AIO flag and prefer synchronous interfaces instead. If AIO must remain enabled, applications must not immediately free or reuse outiov buffers after an error return — they must wait for all kernel completions to finish before releasing those buffers. Red Hat has classified this as Moderate impact and recommends upgrading to a patched libkcapi package when available for affected RHEL and OpenShift versions (Red Hat CVE, Red Hat Bugzilla).

Red Hat, as the CVE Naming Authority (CNA) for this issue, classified the vulnerability as Moderate impact, noting that it does not affect default configurations and requires an opt-in AIO setup combined with a specific error-path trigger. The vulnerability was discovered by Aisle Research in partnership with Red Hat, and Red Hat's advisory includes a detailed proposed patch and mitigation guidance. No significant broader media coverage or notable community commentary beyond standard CVE tracking aggregators has been observed (Red Hat CVE).