Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libkcapi | Aug 25, 2026 | Aug 5, 2026 |
| Redhat_linux | — | Upgrade libkcapi-fipscheck-debuginfoUpgrade libkcapi-tools-debuginfoUpgrade libkcapi-debugsourceUpgrade libkcapiUpgrade libkcapi-hasher-debuginfoUpgrade libkcapi-hmaccalcUpgrade libkcapi-tests-debuginfoUpgrade libkcapi-hasherUpgrade libkcapi-hmaccalc-debuginfoUpgrade libkcapi-debuginfo | Aug 10, 2026 | Aug 5, 2026 |
| Rocky_linux | — | Upgrade libkcapi-hasherUpgrade libkcapiUpgrade libkcapi-hmaccalc-debuginfoUpgrade libkcapi-hmaccalcUpgrade libkcapi-debuginfoUpgrade libkcapi-hasher-debuginfoUpgrade libkcapi-debugsource | Sep 16, 2026 | Sep 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub