CVE-2026-109968

Awaiting Analysis Awaiting Analysis - Queue

LUKS Disk Encryption Passphrase Exposure in Clevis PKCS#11

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109968

EUVD

EUVD-2026-101021

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability involves the clevis PKCS#11 pin component, where the clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.

Detection Guidance

Check for world-readable log files in /run/systemd/ with names matching clevis-pkcs11-*.log. Use commands like 'ls -l /run/systemd/clevis-pkcs11-*.log' to verify permissions. If any log file has permissions like 0644, the vulnerability is present.

Impact Analysis

A local attacker with access to the system could read the log file and obtain the LUKS passphrase. This would allow them to decrypt protected disk contents, potentially exposing sensitive data stored on the disk.

Compliance Impact

This vulnerability could lead to unauthorized access to encrypted data, violating confidentiality requirements in standards like GDPR and HIPAA. Exposure of LUKS passphrases may result in non-compliance with data protection regulations due to potential data breaches.

Mitigation Strategies

Set a restrictive umask of 0077 for the clevis-luks-pkcs11-askpass systemd service. Remove existing log files under /run/systemd/clevis-pkcs11-*.log after each boot. Disable logging for the clevis-pkcs11-afunix-socket-unlock helper if possible.

Hi! I’m here to help you understand CVE-2026-109968. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70