CVE-2026-71225 is a vulnerability in libkcapi where one-shot symmetric cipher operations on inputs larger than 64 KiB in stateful modes (e.g., CTR, CBC) reuse the Initialization Vector (IV) across internal data chunks. This IV reuse can expose relationships in encrypted plaintext, significantly weakening confidentiality and potentially causing incorrect cryptographic processing that affects integrity. The vulnerability affects Red Hat Hardened Images RPMs including libkcapi versions =0.10.1 and =1.5.1-0.1.hum1 on aarch64 and x86_64 architectures. Red Hat advises mitigating the issue by avoiding one-shot symmetric cipher APIs for large inputs and using streaming interfaces or ensuring inputs remain below the chunking threshold. There is no explicit mention of an official patch or fix released yet in the advisory.

The vulnerability leads to significant weakening of data confidentiality due to IV reuse in cryptographic operations on large inputs, potentially exposing encrypted plaintext relationships. It may also affect data integrity by causing incorrect cryptographic processing. The attack complexity is high, no privileges or user interaction are required, and the attack vector is network-based. The CVSS v3.1 base score is 6.5 (medium severity) with high confidentiality impact and low integrity impact.

Red Hat recommends that applications using libkcapi avoid one-shot symmetric cipher APIs for inputs exceeding 64 KiB when continuous-message semantics are critical. Instead, use the streaming interface for processing large messages or ensure one-shot inputs remain below the internal chunking threshold to guarantee consistent IV application. No official patch or update is currently indicated; check Red Hat advisories for updates. Follow vendor guidance and monitor for future fixes.