Описание
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
Отчет
This Moderate impact flaw in libkcapi affects applications utilizing the one-shot Asynchronous I/O (AIO) interfaces with the KCAPI_INIT_AIO flag. Exploitation requires an error to occur after submitting I/O Control Blocks (IOCBs), followed by the application freeing or reusing output buffers before all kernel completions are processed. This vulnerability does not affect default configurations as it relies on an opt-in AIO setup.
Меры по смягчению последствий
To mitigate this issue, applications should avoid initializing libkcapi handles with the KCAPI_INIT_AIO flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that outiov buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libkcapi | Affected | ||
| Red Hat Enterprise Linux 8 | libkcapi | Affected | ||
| Red Hat Enterprise Linux 9 | libkcapi | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected | ||
| Red Hat Hardened Images | libkcapi-main-1.5.1-0.1.hum1 | Fixed | RHSA-2026:56985 | 19.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one ...
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
EPSS
7.3 High
CVSS3