CVE-2026-109971
MediumCVSS 4.7Summary
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
Risk Assessment
A local user could capture the token PIN, potentially leading to unauthorized access to cryptographic keys and data confidentiality breach.
Recommendation
Update clevis to a version that does not pass the PIN in command-line arguments, or use a more secure mechanism for PIN passing.
Other vulnerabilities in clevis
See all- CVE-2026-109970Medium
A flaw in the clevis PKCS#11 pin: the clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without restrictive permissions. Under the default umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
- CVE-2026-109969Medium
A flaw in the clevis PKCS#11 pin: the clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.
- CVE-2026-109976Medium
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.
Original NVD description (English source)
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS