EUVD-2026-98481
GHSA-vqch-3qxf-26cw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access to host
-
DeliveryConnect to AF_UNIX data socket unbound
-
ExploitTrigger integer underflow in getpeername handling
-
ExecutionCrash unlock daemon
-
ImpactBlock LUKS decryption at boot
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the host is configured to use the clevis PKCS#11 pin with the clevis-pkcs11-afunix-socket-unlock daemon running for LUKS unlock - this is a specific, non-default deployment choice, not a stock RHEL install. The attacker must have local access sufficient to open a connection to the daemon's AF_UNIX data socket and must connect without a bound client address to trigger the underflow. Limiting factors: local-only vector (no remote reachability), low-but-nonzero privileges to reach the socket, high attack complexity (AC:H) reflecting the specific unbound-socket condition needed, and impact confined to a single-host boot-time denial of service with no data exposure. |
| Impact | This is a low-to-moderate priority availability-only issue, not an urgent patch. The CVSS 3.1 base score is 4.7 (Medium) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - local attack vector, high attack complexity, low privileges required, and impact limited exclusively to availability (C:N/I:N). There is no confidentiality or integrity exposure; the only outcome is a crash of the clevis-pkcs11-afunix-socket-unlock daemon causing failure of LUKS disk decryption. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so exploitation probability signals are entirely absent. Per the input, there is no KEV status and no public exploit, consistent with a recently disclosed Red Hat-reported memory-safety defect rather than an actively targeted flaw. The AC:H rating and the requirement for a specific, non-default feature (the PKCS#11 pin / AF_UNIX unlock daemon) further constrain real-world risk. Note a tension to verify: the tags label this 'Buffer Overflow' and 'Memory Corruption' (and CWE-787 is out-of-bounds write), yet the described root cause is an integer underflow in getpeername result handling that yields a crash/DoS, with CVSS impact scoped to availability only - so treat this as a crash-type memory-safety bug, not a code-execution primitive, absent further vendor detail. |
| Exploit ScenarioDerived | On a RHEL/OpenShift host configured to use the clevis PKCS#11 pin for network/socket-bound LUKS unlock, a local actor (or a misbehaving local process) opens an AF_UNIX connection to the daemon's data socket without binding a client address. The resulting getpeername call returns a zero-length address, triggering an integer underflow that crashes the daemon and prevents automated disk decryption from completing at boot. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Crashing of the clevis-pkcs11-afunix-socket-unlock daemon in the clevis PKCS#11 pin allows a local attacker to cause a boot-time denial of service on hosts that rely on clevis for LUKS disk decryption. When a client connects to the daemon's AF_UNIX data socket without binding a client address, an integer underflow in the getpeername() result handling corrupts memory (CWE-787) and terminates the daemon, so LUKS unlock never completes and the system cannot finish booting. The issue is availability-only (CVSS 3.1 base 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), affects clevis on Red Hat Enterprise Linux 7, 8, 9 and 10 as well as Red Hat OpenShift Container Platform 4, and no public exploit has been identified at time of analysis; the vulnerable configuration is a non-default deployment choice and not present in a stock RHEL install.
RemediationAI
No vendor-released patch is identified in the available data at time of analysis, so the primary action is to track the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-109976 (Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2550375) and apply the fixed clevis packages as soon as Red Hat publishes them; because the vulnerable daemon only exists in a non-default configuration, administrators should first confirm whether the PKCS#11 pin with the AF_UNIX socket unlock path is actually in use before treating this as urgent. Until a fix ships, the most effective compensating control is to remove the exposure that triggers the underflow: stop and disable clevis-pkcs11-afunix-socket-unlock on hosts that do not require it, or switch LUKS binding to a different pin (TPM2 or Tang) and re-bind the volume with 'clevis luks bind'/'clevis luks unbind' - the trade-off is loss of PKCS#11/HSM-based unlock and the need to re-enroll the volume key. If the PKCS#11 pin must stay, harden the AF_UNIX socket path with restrictive filesystem ownership/mode and a tailored SELinux policy so only the intended account can connect, since the attacker must open a connection to the socket to trigger the crash; this can break unlock automation or non-root unlock workflows. Ensure every affected host retains a working LUKS passphrase or recovery key so an operator can still bring the system up when the daemon crashes, and consider configuring the helper unit with systemd Restart=on-failure and alerting as a short-term resilience measure, recognizing that a restart does not prevent the memory corruption itself.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Clevis is Red Hat's framework for binding secrets - typically LUKS volume keys - to a trust anchor via pluggable 'pins' such as Tang, TPM2 and PKCS#11, so a disk can be unlocked automatically at boot. The PKCS#11 pin can unlock a volume through a hardware token or HSM, and in this deployment model a helper process, clevis-pkcs11-afunix-socket-unlock, exposes an AF_UNIX (Unix domain) data socket that local clients connect to in order to request an unlock. The daemon inspects the connecting peer with getpeername(); if the client socket was never bound to an address, the returned address length is degenerate and the length arithmetic in the daemon underflows, producing an out-of-bounds write (CWE-787; Red Hat tags the issue as buffer overflow, memory corruption and denial of service). The result is memory corruption that crashes the daemon rather than a clean error path, so the pin fails closed and LUKS decryption cannot be completed during boot. Because the daemon is reached over a local Unix socket, the vector is local-only (AV:L) with a high attack complexity (AC:H) tied to the specific unbound-socket condition and low privileges (PR:L); there is no confidentiality or integrity impact, only loss of availability on the affected host.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local AF_UNIX socket so AV:L; the specific unbound-client condition gives AC:H; local socket access gives PR:L; crash-only impact is A:H with C:N/I:N.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Exploit-DB