CVE-2026-71227

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications should avoid initializing libkcapi handles with KCAPI_INIT_AIO if AIO functionality is not strictly required. If AIO must be used, applications should destroy and reinitialize libkcapi handles after any AIO completion error, rather than reusing them for subsequent AIO operations.