Upgrade libkcapi package to version 1.5.1 to fix CVE-2026-71225[Medium], CVE-2026-71226[High], CVE-2026-71227[Medium]

[durgajagadeesh]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

• CVE-2026-71225 [Medium],
  Upgrading to a version 1.5.1 fixed this CVE, since the affected range for this CVE is before 1.5.1

• CVE-2026-71226 [High],
  Upgrading to a version 1.5.1 fixed this CVE, since the affected range for this CVE is before 1.5.1

• CVE-2026-71227 [Medium],
  Upgrading to a version 1.5.1 fixed this CVE, since the affected range for this CVE is before 1.5.1

Change Log

./SPECS/libkcapi/libkcapi.spec
./SPECS/libkcapi/libkcapi.signatures.json
./cgmanifest.json

Does this affect the toolchain?

NO

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-YYYY-XXXX

Test Methodology

• Pipeline build id: xxxx
• Buddy build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1179842&view=results

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[durgajagadeesh]

libkcapi 1.5.0 → 1.5.1 — Change Breakdown & Compatibility Analysis

Verdict: low-risk, drop-in compatible security upgrade. No ABI break, no API change, no packaging change.

Evidence base

Both tarballs verified authentic — 1.5.0 hashes to 15b550c1…c716e9, exactly matching the Azure Linux signature manifest. Comparison used the real sources plus the built 1.5.0-2 and 1.5.1-1 RPMs in out/RPMS/x86_64.

Change breakdown

53 files differ. Upstream CHANGES.md for 1.5.1:

Change	Type
fix memory corruption (CVE-2026-71226)	Security
fix potential for an infinite loop (CVE-2026-71227)	Security
add safety measure to prevent IV reuse (CVE-2026-71225)	Security
kcapi-enc: tag processing in decryption without ciphertext	Feature
remove tests of ansi_cprng	Test
change suggestions derived from Claude code	Cleanup

 

One finding worth explaining: lib/version.lds drops kcapi_aead_getdata and kcapi_aead_outbuflen, which looks like an ABI break. It isn't — nm -D on the 1.5.0 library confirms those symbols were never exported. They were stale entries left behind when the functions were removed in an earlier release; the real _input/_output/_enc/_dec variants (8 symbols) are present in both builds.

Packaging compatibility (Azure Linux)

• File lists across all 7 subpackages (libkcapi, -devel, -tools, -fipscheck, -hmaccalc, -static, -tests) are byte-identical after version normalization.

• Provides are purely additive — only libkcapi.so.1(LIBKCAPI_1.5.1) is new.

• Release reset 2 → 1 is correct; EVR still increases (1.5.0-2 < 1.5.1-1), so the upgrade path is intact.

• fipscheck_next_evr = 1.5.0-10 correctly stays unchanged — it tracks the obsoleted fipscheck project's version, not libkcapi. The matching numbers are coincidental.

Behavior changes to be aware of

1. AEAD with empty input now still emits/verifies a tag where 1.5.0 produced no output — a deliberate correctness fix, but it changes kcapi-enc output for that edge case.
2. Stricter checkfile parsing — malformed lines now fail with "Invalid checkfile format" instead of reading out of bounds. Previously "working" malformed checkfiles will now be rejected.
3. vmsplice EPERM fallback to sendmsg improves reliability in restricted/container environments.

4. Makefile.am switched hasher symlinks in %{_libexecdir} from relative to absolute (/usr/bin/kcapi-hasher) — packaged output is unchanged.

 

Downstream impact

Direct dependent: SPECS/dracut/dracut.spec. The hmac/FIPS drop-ins (sha512hmac, fipscheck) are additionally relied on by kernel, kernel-hwe, kernel-64k, kernel-mshv, cryptsetup, libreswan, and libxcrypt for integrity verification. Since file lists and the dracut hard-link aliases are unchanged, no rebuild of consumers is required.

Recommended validation

Given the FIPS-critical role, before merging I'd suggest running libkcapi-tests (particularly hasher-test.sh) and smoke-testing a dracut FIPS boot, since sha512hmac runs in the initramfs and is the one place the stricter checkfile parsing could surface.