CVE-2026-71225 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

Medium 6.5 Published 5 Aug 2026 Updated 22 Oct 2026

Attackers can weaken data confidentiality and integrity by exploiting IV reuse in libkcapi during large symmetric cipher operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-71225?

CVE-2026-71225 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.

Weakness: CWE-330

Which versions are affected by CVE-2026-71225?

It affects 4 products.

Products include Redhat Enterprise Linux, Redhat Hardened Images, Redhat Openshift Container Platform, Smuellerdd Libkcapi.

How do I fix CVE-2026-71225?

Apply the vendor's patch.

Is CVE-2026-71225 being exploited?

There is no known exploitation of CVE-2026-71225 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2026-71225, AZL-94655, BELL-CVE-2026-71225, DEBIAN-CVE-2026-71225, GHSA-qv62-qmw8-96h9, OESA-2026-3575 and 1 more.