clevis PKCS#11 CVE-2026-109969

Exploitation requires (1) a host running the clevis-pkcs11-afunix-socket-unlock daemon as part of a clevis PKCS#11 LUKS unlock configuration, (2) a permissive process umask that leaves the daemon-created AF_UNIX control and data sockets world-accessible, and (3) an authenticated local user account on that host to connect to the sockets. Exploitation is LIMITED by all three: it is local-only (no remote/network path), it does not work under a restrictive default umask, and the clevis PKCS#11 afunix unlock mechanism must actually be in use. There is no required user interaction with a victim. These conditions explain the AC:H rating - the permissive-umask dependency is a non-default state the attacker cannot control.

This is a genuine but modest-priority local privilege/confidentiality issue, not a mass-exploitation threat. The official CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N = 4.7 Medium) is internally consistent and matches the description: an attacker needs an existing local account (PR:L), the flaw is only reachable under a permissive process umask rather than a default configuration (AC:H), and the headline impact is theft of LUKS passphrases (C:H). No EPSS score, CISA KEV listing, SSVC decision, or public POC was supplied, so exploitation likelihood must be inferred as low-to-moderate: the CWE-306 (missing authentication) root cause makes exploitation trivial IN PRINCIPLE once the umask precondition holds, but the local-only vector and umask dependency sharply limit real-world reach. One signal tension worth flagging: the description says the attacker can also 'inject arbitrary device/key pairs,' which is an integrity effect, yet the vendor vector sets I:N - verify with Red Hat whether injection should carry an integrity impact. Bottom line: patch on a normal cadence; this is not an emergency unless clevis PKCS#11 afunix unlock is deployed on multi-user hosts with loose umask settings.

On a RHEL host using the clevis PKCS#11 afunix-socket unlock daemon with a permissive umask, a logged-in local user enumerates the unprotected AF_UNIX control and data sockets. Because the daemon performs no peer credential verification, the attacker connects to the data socket and reads the LUKS passphrase, or connects to the control socket to inject an attacker-controlled device/key pair. No public exploit identified at time of analysis, so this would require a custom socket client.