The vulnerability in libkcapi arises when performing one-shot symmetric cipher operations on inputs larger than 64 KiB in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC). The library improperly reuses the Initialization Vector (IV) for each internal data chunk, which can lead to weakening of data confidentiality by revealing relationships in encrypted plaintext and potentially affecting data integrity due to incorrect cryptographic processing. A remote attacker could exploit this by causing an application using libkcapi to process specially crafted large inputs. The issue is specific to Red Hat Enterprise Linux 10. The vendor advisory recommends avoiding one-shot symmetric cipher APIs for large inputs and instead using streaming interfaces or ensuring inputs remain below the chunking threshold. There is no confirmed official fix or patch available at this time.

The vulnerability can significantly weaken data confidentiality by exposing relationships in encrypted plaintext due to repeated IV reuse. It may also impact data integrity by causing incorrect cryptographic processing. The CVSS score of 6.5 reflects a medium severity with high confidentiality impact and low integrity impact. There are no known exploits in the wild. The flaw requires network attack vector with high attack complexity and no privileges or user interaction needed.

No official patch or fix is currently confirmed for this vulnerability. To mitigate the issue, applications using libkcapi should avoid using one-shot symmetric cipher APIs for inputs exceeding 64 KiB when continuous-message semantics are critical. Instead, they should use the streaming interface for processing large messages or ensure that one-shot inputs remain below the internal chunking threshold to guarantee consistent IV application throughout the operation. Monitor the vendor advisory for updates on patch availability.