This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-71227 →

DEBIAN-CVE-2026-71227

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO...

Original description

The description as published by the source.

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 libkcapi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1"}]}]

References

advisory security-tracker.debian.org