CVE-2026-109976 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for managing systems that use clevis and rely on LUKS disk decryption during boot should assess their exposure and take necessary actions to prevent potential denial-of-service attacks.

Why it matters

The integer underflow vulnerability in the clevis PKCS#11 pin can cause a denial of service, preventing LUKS disk decryption from completing during boot. Defenders should prioritize verifying the clevis package version and applying patches to prevent potential attacks.

• Denial of service during LUKS disk decryption
• Potential disruption to system boot processes
• Need for verification of clevis package version and patch application

Technical summary

The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot. The vulnerability is caused by a lack of proper input validation in the clevis PKCS#11 pin. Defenders should prioritize verifying the clevis package version and applying patches to prevent potential denial-of-service attacks. This is particularly important for systems relying on LUKS disk decryption during boot.

Defensive priority

Defenders should prioritize verifying the clevis package version and applying patches to prevent potential denial-of-service attacks. This is particularly important for systems relying on LUKS disk decryption during boot.

Recommended defensive actions

• Verify the clevis package version on affected systems
• Apply patches or updates provided by the vendor
• Monitor system logs for potential denial-of-service attacks
• Consider implementing compensating controls to mitigate the impact of a potential attack
• Review system configurations for potential exposure
• Track exceptions and retest remediated assets
• Implement additional monitoring and detection controls

Evidence notes

The CVE record and source item provide details on the integer underflow vulnerability in the clevis PKCS#11 pin. The NVD entry is currently not available. The vulnerability was reported by a third-party researcher and is publicly disclosed. There are no known exploits in the wild, but defenders should verify the clevis package version and apply patches to prevent potential attacks. The vulnerability affects systems using clevis and relying on LUKS disk decryption during boot.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.