This vulnerability exists in the _kcapi_aio_read_all() function of libkcapi, where reusing an AIO-enabled handle after a prior completion error causes the function to enter a non-terminating wait loop. The flaw leads to an infinite loop condition (CWE-835) that causes resource exhaustion and persistent denial of service. The issue affects applications that use libkcapi with AIO functionality enabled. The vulnerability has a CVSS v3.1 base score of 5.1 (medium severity) with a local attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. No official patch or fix has been confirmed yet. The vendor advisory recommends mitigation by avoiding initialization of libkcapi handles with KCAPI_INIT_AIO if AIO is not strictly required, or by destroying and reinitializing handles after any AIO completion error instead of reusing them.

The vulnerability allows a local attacker to cause an application or thread using libkcapi's AIO interface to enter an infinite loop, resulting in persistent denial of service due to resource exhaustion. This makes the affected application or thread unresponsive, impacting availability. There is no impact on confidentiality or integrity.

Red Hat's advisory recommends that applications avoid initializing libkcapi handles with KCAPI_INIT_AIO unless AIO functionality is strictly necessary. If AIO must be used, applications should destroy and reinitialize libkcapi handles after any AIO completion error rather than reusing them. No official patch or fix is currently confirmed; users should monitor the vendor advisory for updates.