From 3a085e4cca0d8e5f64cd48bfff91e38a8650c81c Mon Sep 17 00:00:00 2001
From: Zoltan Fridrich <zfridric@redhat.com>
Date: Tue, 18 Aug 2026 12:03:52 +0200
Subject: [PATCH] Fix CVE-2026-71226

Fix memory corruption via uncanceled AIO requests
on error in libkcapi's one-shot AIO path

Resolves: RHEL-224815

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
 007-CVE-2026-71226.patch | 76 ++++++++++++++++++++++++++++++++++++++++
 libkcapi.spec            |  4 +++
 2 files changed, 80 insertions(+)
 create mode 100644 007-CVE-2026-71226.patch

diff --git a/007-CVE-2026-71226.patch b/007-CVE-2026-71226.patch
new file mode 100644
index 0000000..86e3990
--- /dev/null
+++ b/007-CVE-2026-71226.patch
@@ -0,0 +1,76 @@
+diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c
+index 0df1a02..9f93603 100644
+--- a/lib/kcapi-kernel-if.c
++++ b/lib/kcapi-kernel-if.c
+@@ -421,6 +421,8 @@ ssize_t _kcapi_common_vmsplice_chunk(struct kcapi_handle *handle,
+ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread,
+ 			struct timespec *timeout)
+ {
++	int err = 0;
++
+ 	if (toread > KCAPI_AIO_CONCURRENT)
+ 		return -EINVAL;
+
+@@ -431,41 +433,34 @@ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread,
+ 				      events, timeout);
+
+ 		if (rc < 0)
+-			return rc;
++			return err == 0 ? rc : err;
+
+ 		for (i = 0; i < rc; i++) {
+ 			struct iocb *cb;
++			uint64_t idx = events[i].data;
+
+-			/*
+-			 * If one cipher operation fails, so will the entire
+-			 * AIO operation
+-			 */
+-			if (events[i].res < 0) {
+-				handle->aio.iocb_ret[events[i].data] =
+-							events[i].res;
+-				return (int)events[i].res;
++			if (idx >= KCAPI_AIO_CONCURRENT) {
++				if (err == 0)
++					err = -EOVERFLOW;
++				continue;
+ 			}
+
+ 			cb = (struct iocb *)(uintptr_t)events[i].obj;
+
+-			/*
+-			 * Older symmetric AIO implementations used a wrong
+-			 * return code.
+-			 */
+-			if (events[i].res > 0) {
+-				handle->aio.iocb_ret[events[i].data] =
+-								events[i].res;
++			if (events[i].res == 0) {
++				handle->aio.iocb_ret[idx] = (__s64)cb->aio_nbytes;
+ 			} else {
+-				handle->aio.iocb_ret[events[i].data] =
+-							(__s64)cb->aio_nbytes;
++				handle->aio.iocb_ret[idx] = events[i].res;
++				if (events[i].res < 0 && err == 0)
++					err = (int)events[i].res;
+ 			}
+
+ 			cb->aio_fildes = 0;
+ 		}
+-		toread -= (uint32_t)rc;
++		toread -= (size_t)rc;
+ 	}
+
+-	return 0;
++	return err;
+ }
+
+ int _kcapi_aio_send_iov(struct kcapi_handle *handle, struct iovec *iov,
+@@ -541,6 +536,7 @@ int _kcapi_aio_read_iov(struct kcapi_handle *handle,
+ 		} else {
+ 			kcapi_dolog(KCAPI_LOG_ERR,
+ 				    "Could not sumbit AIO read\n");
++			_kcapi_aio_read_all(handle, (size_t)ret, NULL);
+ 			return -EIO;
+ 		}
+ 	}
diff --git a/libkcapi.spec b/libkcapi.spec
index 78c7bce..c94d314 100644
--- a/libkcapi.spec
+++ b/libkcapi.spec
@@ -139,6 +139,7 @@ Patch3:         003-zeroize-hasher.patch
 Patch4:         004-hasher-target-option.patch
 Patch5:         005-fips-mode-tests.patch
 Patch6:         006-aead-tag-verification.patch
+Patch7:         007-CVE-2026-71226.patch
 
 BuildRequires:  bash
 BuildRequires:  coreutils
@@ -526,6 +527,9 @@ popd
   Resolves: RHEL-242707
 - Add tag processing in AEAD decryption without ciphertext
   Resolves: RHEL-242667
+- CVE-2026-71226: Fix memory corruption via uncanceled AIO requests
+  on error in libkcapi's one-shot AIO path
+  Resolves: RHEL-224815
 
 * Fri Dec 01 2023 Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
 - Backport fixes for kcapi-hasher target option