Description
A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Stephan Muelle | libkcapi | 0.10.1 – < 1.5.1 | 1.5.1 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libkcapi | 1.5.1-1 | — |
| Debian 13 | libkcapi | No fix yet | — |
| Debian 12 | libkcapi | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libkcapi | No fix yet | — |
| Ubuntu 26.04 LTS | libkcapi | No fix yet | — |
| Ubuntu 24.04 LTS | libkcapi | No fix yet | — |
| Ubuntu 22.04 LTS | libkcapi | No fix yet | — |
| Ubuntu 20.04 LTS | libkcapi | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libkcapi | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | libkcapi | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | libkcapi | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | libkcapi | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | libkcapi | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | libkcapi | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | libkcapi | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | libkcapi | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | libkcapi | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libkcapi +2 | 1.5.1-1.el10_2 | RHSA-2026:67267 |
| RHEL 9 | libkcapi +1 | 1.4.0-3.el9_8 | RHSA-2026:67265 |
| RHEL 8 | libkcapi +1 | 1.4.0-3.el8_10 | RHSA-2026:67266 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | libkcapi | 1.5.0-6.el10_0 | RHSA-2026:69285 |
| RHEL 9.6 EUS | libkcapi +1 | 1.4.0-2.el9_6.1 | RHSA-2026:87712 |
| Red Hat Hardened Images 1 | libkcapi +7 | 1.5.1-0.1.hum1 | RHSA-2026:56985 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libkcapi +2 | 1.5.1-1.el10_2 | ALSA-2026:67267 |
| AlmaLinux 9 | libkcapi +1 | 1.4.0-3.el9_8 | ALSA-2026:67265 |
| AlmaLinux 8 | libkcapi +1 | 1.4.0-3.el8_10 | ALSA-2026:67266 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libkcapi | 1.5.1-1.el10_2 | RLSA-2026:67267 |
| Rocky Linux 9 | libkcapi | 1.4.0-3.el9_8 | RLSA-2026:67265 |
| Rocky Linux 8 | libkcapi | 1.4.0-3.el8_10 | RLSA-2026:67266 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libkcapi | 1.5.1-r0 | — |
| Alpine v3.23 | libkcapi | 1.5.1-r0 | — |
| Alpine v3.22 | libkcapi | 1.5.1-r0 | — |
| Alpine v3.21 | libkcapi | 1.5.1-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libkcapi | 1.5.1-1 | — |
Advisories 13
- RHSA-2026:87712 Red Hat Security Advisory: libkcapi security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3322 Red Hat Enterprise Linux (libkcapi): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2026:67265 Moderate: libkcapi security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67267 Moderate: libkcapi security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67266 Moderate: libkcapi security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:56985 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:69285 Red Hat Security Advisory: libkcapi security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:67267 Red Hat Security Advisory: libkcapi security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:67265 Red Hat Security Advisory: libkcapi security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:67266 Red Hat Security Advisory: libkcapi security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RLSA-2026:67265 Moderate: libkcapi security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 15, 2026
- RLSA-2026:67267 Moderate: libkcapi security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 15, 2026
- RLSA-2026:67266 Moderate: libkcapi security update Rocky Linux Security Advisories · Sep 15, 2026
References
- RHSA-2026:56985 vendor-advisory
- RHSA-2026:67265 vendor-advisory
- RHSA-2026:67266 vendor-advisory
- RHSA-2026:67267 vendor-advisory
- RHSA-2026:69285 vendor-advisory
- RHSA-2026:87712 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-71225 vdb-entry
- RHBZ#2462011 issue-tracking