From ee4dc5b13b80ed962d23cd015a09c25caf284c7a Mon Sep 17 00:00:00 2001
From: Zoltan Fridrich <zfridric@redhat.com>
Date: Tue, 18 Aug 2026 12:48:07 +0200
Subject: [PATCH] Fix CVE-2026-71226

Fix memory corruption via uncanceled AIO requests
on error in libkcapi's one-shot AIO path

Resolves: RHEL-224809

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
---
 006-CVE-2026-71226.patch | 76 ++++++++++++++++++++++++++++++++++++++++
 libkcapi.spec            |  8 ++++-
 2 files changed, 83 insertions(+), 1 deletion(-)
 create mode 100644 006-CVE-2026-71226.patch

diff --git a/006-CVE-2026-71226.patch b/006-CVE-2026-71226.patch
new file mode 100644
index 0000000..86e3990
--- /dev/null
+++ b/006-CVE-2026-71226.patch
@@ -0,0 +1,76 @@
+diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c
+index 0df1a02..9f93603 100644
+--- a/lib/kcapi-kernel-if.c
++++ b/lib/kcapi-kernel-if.c
+@@ -421,6 +421,8 @@ ssize_t _kcapi_common_vmsplice_chunk(struct kcapi_handle *handle,
+ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread,
+ 			struct timespec *timeout)
+ {
++	int err = 0;
++
+ 	if (toread > KCAPI_AIO_CONCURRENT)
+ 		return -EINVAL;
+
+@@ -431,41 +433,34 @@ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread,
+ 				      events, timeout);
+
+ 		if (rc < 0)
+-			return rc;
++			return err == 0 ? rc : err;
+
+ 		for (i = 0; i < rc; i++) {
+ 			struct iocb *cb;
++			uint64_t idx = events[i].data;
+
+-			/*
+-			 * If one cipher operation fails, so will the entire
+-			 * AIO operation
+-			 */
+-			if (events[i].res < 0) {
+-				handle->aio.iocb_ret[events[i].data] =
+-							events[i].res;
+-				return (int)events[i].res;
++			if (idx >= KCAPI_AIO_CONCURRENT) {
++				if (err == 0)
++					err = -EOVERFLOW;
++				continue;
+ 			}
+
+ 			cb = (struct iocb *)(uintptr_t)events[i].obj;
+
+-			/*
+-			 * Older symmetric AIO implementations used a wrong
+-			 * return code.
+-			 */
+-			if (events[i].res > 0) {
+-				handle->aio.iocb_ret[events[i].data] =
+-								events[i].res;
++			if (events[i].res == 0) {
++				handle->aio.iocb_ret[idx] = (__s64)cb->aio_nbytes;
+ 			} else {
+-				handle->aio.iocb_ret[events[i].data] =
+-							(__s64)cb->aio_nbytes;
++				handle->aio.iocb_ret[idx] = events[i].res;
++				if (events[i].res < 0 && err == 0)
++					err = (int)events[i].res;
+ 			}
+
+ 			cb->aio_fildes = 0;
+ 		}
+-		toread -= (uint32_t)rc;
++		toread -= (size_t)rc;
+ 	}
+
+-	return 0;
++	return err;
+ }
+
+ int _kcapi_aio_send_iov(struct kcapi_handle *handle, struct iovec *iov,
+@@ -541,6 +536,7 @@ int _kcapi_aio_read_iov(struct kcapi_handle *handle,
+ 		} else {
+ 			kcapi_dolog(KCAPI_LOG_ERR,
+ 				    "Could not sumbit AIO read\n");
++			_kcapi_aio_read_all(handle, (size_t)ret, NULL);
+ 			return -EIO;
+ 		}
+ 	}
diff --git a/libkcapi.spec b/libkcapi.spec
index 2300911..2d24e02 100644
--- a/libkcapi.spec
+++ b/libkcapi.spec
@@ -124,7 +124,7 @@ done                                                             \
 
 Name:           libkcapi
 Version:        %{vmajor}.%{vminor}.%{vpatch}
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        User space interface to the Linux Kernel Crypto API
 
 License:        BSD-3-Clause OR GPL-2.0-only
@@ -139,6 +139,7 @@ Patch2:         002-fips-disable-ansi_cprng.patch
 Patch3:         003-zeroize-hasher.patch
 Patch4:         004-hasher-target-option.patch
 Patch5:         005-fips-mode-tests.patch
+Patch6:         006-CVE-2026-71226.patch
 
 BuildRequires:  bash
 BuildRequires:  coreutils
@@ -517,6 +518,11 @@ popd
 
 
 %changelog
+* Tue Aug 18 2026 Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-3
+- CVE-2026-71226: Fix memory corruption via uncanceled AIO requests
+  on error in libkcapi's one-shot AIO path
+  Resolves: RHEL-224809
+
 * Fri Dec 01 2023 Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
 - Backport fixes for kcapi-hasher target option
   Related: RHEL-15300