CVE-2026-109969

Awaiting Analysis Awaiting Analysis - Queue

clevis PKCS#11 pin AF_UNIX socket privilege escalation

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: redhat-SADP

Description

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109969

EUVD

EUVD-2026-100954

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Enterprise Linux 10 *
Red	Hat	Red Hat Enterprise Linux 7 *
Red	Hat	Red Hat Enterprise Linux 8 *
Red	Hat	Red Hat Enterprise Linux 9 *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is in the clevis PKCS#11 pin component. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without proper permission restrictions or peer credential verification. Under a permissive process umask, local users can connect to these sockets to inject arbitrary device or key pairs or receive LUKS passphrases.

Detection Guidance

Check the umask of the clevis-luks-pkcs11-askpass systemd service by running: systemctl show clevis-luks-pkcs11-askpass.service -p UMask. Inspect socket permissions with: ls -l /run/clevis/luks/askpass/*.sock. Use socat to test socket access: socat - UNIX-CONNECT:/run/clevis/luks/askpass/control.sock.

Verify if the umask is permissive (e.g., 0000) which allows unauthorized access. Check dracut initramfs configurations if the system uses them for early boot processes.

Impact Analysis

An attacker with local access could exploit this to inject malicious keys or retrieve LUKS passphrases, potentially leading to unauthorized access to encrypted data or privilege escalation. The impact depends on system configuration and umask settings.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected systems may face compliance risks if data is exposed due to exploitation.

Mitigation Strategies

Set a restrictive umask (0077) for the clevis-luks-pkcs11-askpass systemd service by editing the service file and adding UMask=0077. Restart the service afterward: systemctl daemon-reload && systemctl restart clevis-luks-pkcs11-askpass.service.

Ensure the default systemd umask (0022) is enforced system-wide. For dracut initramfs, review and update configurations to enforce restrictive permissions during early boot.

Hi! I’m here to help you understand CVE-2026-109969. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70