{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nlibkcapi:\n  * libkcapi-1.5.1-0.1.hum1 (aarch64, x86_64)\n  * libkcapi-devel-1.5.1-0.1.hum1 (aarch64, x86_64)\n  * libkcapi-fipscheck-1.5.1-0.1.hum1 (aarch64, x86_64)\n  * libkcapi-hasher-1.5.1-0.1.hum1 (aarch64, x86_64)\n  * libkcapi-hmaccalc-1.5.1-0.1.hum1 (aarch64, x86_64)\n  * libkcapi-static-1.5.1-0.1.hum1 (aarch64, x86_64)\n  * libkcapi-tests-1.5.1-0.1.hum1 (aarch64, x86_64)\n  * libkcapi-tools-1.5.1-0.1.hum1 (aarch64, x86_64)\n  * libkcapi-1.5.1-0.1.hum1.src (src)\n\nSecurity Fix(es):\n\nlibkcapi:\n  * CVE-2026-71225\n  * CVE-2026-71226\n  * CVE-2026-71227",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:56985",
        "url": "https://access.redhat.com/errata/RHSA-2026:56985"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71225",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71225"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71226",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71226"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71227",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71227"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56985.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-23T05:57:00+00:00",
      "generator": {
        "date": "2026-08-23T05:57:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:56985",
      "initial_release_date": "2026-08-19T13:15:02+00:00",
      "revision_history": [
        {
          "date": "2026-08-19T13:15:02+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-23T05:57:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libkcapi-main@aarch64",
                "product": {
                  "name": "libkcapi-main@aarch64",
                  "product_id": "libkcapi-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libkcapi@1.5.1-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libkcapi-main@src",
                "product": {
                  "name": "libkcapi-main@src",
                  "product_id": "libkcapi-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libkcapi@1.5.1-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libkcapi-main@x86_64",
                "product": {
                  "name": "libkcapi-main@x86_64",
                  "product_id": "libkcapi-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libkcapi@1.5.1-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libkcapi-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libkcapi-main@aarch64"
        },
        "product_reference": "libkcapi-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libkcapi-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libkcapi-main@src"
        },
        "product_reference": "libkcapi-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libkcapi-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libkcapi-main@x86_64"
        },
        "product_reference": "libkcapi-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-71225",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "discovery_date": "2026-04-26T18:00:31+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462011"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libkcapi-main@aarch64",
          "Red Hat Hardened Images:libkcapi-main@src",
          "Red Hat Hardened Images:libkcapi-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71225"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462011",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462011"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71225",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71225"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71225",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71225"
        }
      ],
      "release_date": "2026-08-05T11:55:38.243000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:15:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56985"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications using `libkcapi` should avoid the one-shot symmetric cipher APIs for inputs exceeding 64 KiB when continuous-message semantics are critical. Instead, prefer the streaming interface for processing large messages, or ensure one-shot inputs remain below the internal chunking threshold to guarantee the IV is applied consistently throughout the operation.",
          "product_ids": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libkcapi: IV reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-71226",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-04-26T18:17:10+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462114"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Memory Corruption via Uncanceled AIO Requests on Error: libkcapi\u0027s one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi\u0027s one-shot AIO path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in libkcapi affects applications utilizing the one-shot Asynchronous I/O (AIO) interfaces with the `KCAPI_INIT_AIO` flag. Exploitation requires an error to occur after submitting I/O Control Blocks (IOCBs), followed by the application freeing or reusing output buffers before all kernel completions are processed. This vulnerability does not affect default configurations as it relies on an opt-in AIO setup.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libkcapi-main@aarch64",
          "Red Hat Hardened Images:libkcapi-main@src",
          "Red Hat Hardened Images:libkcapi-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71226"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462114",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462114"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71226",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71226"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71226",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71226"
        }
      ],
      "release_date": "2026-08-05T12:22:09.014000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:15:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56985"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory.",
          "product_ids": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi\u0027s one-shot AIO path"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-71227",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-04-26T20:17:44+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462867"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libkcapi-main@aarch64",
          "Red Hat Hardened Images:libkcapi-main@src",
          "Red Hat Hardened Images:libkcapi-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71227"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462867",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462867"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71227",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71227"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71227",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71227"
        }
      ],
      "release_date": "2026-08-05T12:29:09.516000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-19T13:15:02+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:56985"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications should avoid initializing `libkcapi` handles with `KCAPI_INIT_AIO` if AIO functionality is not strictly required. If AIO must be used, applications should destroy and reinitialize `libkcapi` handles after any AIO completion error, rather than reusing them for subsequent AIO operations.",
          "product_ids": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libkcapi-main@aarch64",
            "Red Hat Hardened Images:libkcapi-main@src",
            "Red Hat Hardened Images:libkcapi-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libkcapi: Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return"
    }
  ]
}