PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42014 Red Hat CVE debrief

A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
MEDIUM 6.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-16
Original CVE updated
2026-09-01
Advisory published
2026-06-16
Advisory updated
2026-09-01

Who should care

Users of GnuTLS, particularly those in industries relying on secure cryptographic operations, should be aware of this vulnerability. This includes but is not limited to Linux distributions, as GnuTLS is widely used in various applications and systems.

Technical summary

The vulnerability is caused by the `gnutls_pkcs11_token_set_pin` function not properly handling the change of the Security Officer PIN when the old PIN is NULL and the token lacks a protected authentication path. This leads to a use-after-free vulnerability, which could potentially allow an attacker to execute arbitrary code or cause a denial of service.

Defensive priority

Medium

Recommended defensive actions

  • Apply patches or updates provided by the GnuTLS maintainers or relevant Linux distributions as soon as possible.
  • Review and update cryptographic operations to ensure secure authentication paths are used.
  • Consider implementing additional security measures, such as monitoring for suspicious activity related to PIN changes.

Evidence notes

The CVE-2026-42014 record was sourced from the National Vulnerability Database (NVD) and CVE.org. Additional information was gathered from Red Hat's security advisories and GnuTLS's official security announcements.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42014 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42014

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42014 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42014

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.