CVE-2026-71226 is a use after free in libkcapi, a library for the Linux kernel crypto API. The record scores it high (CVSS 7.3), while Red Hat's errata rate the update Moderate. A one-shot async I/O path can return an error before all requests are drained. Update libkcapi from your vendor.
What's affected
libkcapi, as shipped in Red Hat Enterprise Linux, Red Hat Hardened Images and OpenShift Container Platform, according to the record. The Red Hat errata I fetched include a libkcapi 1.4.0-3.el8_10 package for RHEL 8 and a libkcapi 1.5.1-0.1.hum1 package for Hardened Images. Other RHEL releases have their own errata, listed on the Red Hat CVE page.
The weakness is CWE-416. In the library's one-shot AIO path, an error can be returned before all submitted I/O control blocks are drained. The kernel may then write into output buffers owned by the caller after the caller has moved on, which corrupts memory.
Severity differs by source. The record gives 7.3 high with a local vector. Red Hat Product Security rates the update itself as Moderate.
How to check if you're exposed
Check the installed package version:
rpm -q libkcapi
Then see whether your release has an erratum for this CVE:
dnf updateinfo list cves --cve CVE-2026-71226
In containers, run the same rpm query inside the image, or scan the image and look for libkcapi. The library is a dependency of tools that use the kernel crypto API, for example for hashing and FIPS checks, so it can be present on systems where no one chose to install it.
OpenShift nodes get updates through their own release process, so check the OpenShift advisory path for your cluster version as well.
free in-browser dependency scan checks application dependencies, so use the commands above for the OS package.
What to do now
- Run rpm -q libkcapi on hosts and inside container images.
- Use dnf updateinfo to find the erratum for your RHEL release and apply it.
- For Hardened Images, move to the image build that carries the fixed libkcapi package.
- For OpenShift, check the advisory for your cluster version and plan the node update.
- Rebuild images that bundle libkcapi from an older base.
Why it matters
CWE-416 here involves two parties. The kernel completes asynchronous work later, and the library hands it buffers belonging to the caller. If the library returns early on error without cancelling the pending requests, the kernel will later write into memory the caller may have freed or reused.
The local vector and low privileges required keep this out of the critical band, but the pattern matters for anyone writing async code: on every error path, either wait for the outstanding operations or cancel them before releasing the buffers.
Quick check
Why do the record and Red Hat show different severity?
The record gives a CVSS 7.3 high score. Red Hat Product Security rates the erratum Moderate. They are separate assessments, so use your own risk context.
Sources
Last reviewed: 18 October 2026.
