This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-71226 →

DEBIAN-CVE-2026-71226

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allow...

Original description

The description as published by the source.

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1"}]}]

References

advisory security-tracker.debian.org