CVE-2026-109976
MediumCVSS 4.7Summary
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.
Risk Assessment
The daemon crash can prevent LUKS disk decryption during boot, potentially leading to system or data unavailability.
Recommendation
Apply the vendor patch for clevis that fixes getpeername handling, or restrict access to the AF_UNIX socket to trusted clients only.
Other vulnerabilities in clevis
See all- CVE-2026-109971Medium
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
- CVE-2026-109970Medium
A flaw in the clevis PKCS#11 pin: the clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without restrictive permissions. Under the default umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
- CVE-2026-109969Medium
A flaw in the clevis PKCS#11 pin: the clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.
Original NVD description (English source)
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS