This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-71227 →

ALPINE-CVE-2026-71227

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO...

Original description

The description as published by the source.

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.21 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"1.5.1-r0"}]}]

Alpine:v3.22 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"1.5.1-r0"}]}]

Alpine:v3.23 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"1.5.1-r0"}]}]

Alpine:v3.24 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"1.5.1-r0"}]}]

References

advisory security.alpinelinux.org