Your message dated Sat, 24 Oct 2026 19:40:27 +0000
with message-id <[email protected]>
and subject line Bug#1150905: fixed in clevis 24-1
has caused the Debian Bug report #1150905,
regarding clevis: CVE-2026-109976
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150905: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150905
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: clevis
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for clevis.
CVE-2026-109976[0]:
| A flaw was found in the clevis PKCS#11 pin. The clevis-
| pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client
| connects to the data socket without a bound address, due to an
| integer underflow in the getpeername result handling. This causes a
| denial of service, preventing LUKS disk decryption from completing
| during boot.
https://bugzilla.redhat.com/show_bug.cgi?id=2550375
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-109976
https://www.cve.org/CVERecord?id=CVE-2026-109976
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: clevis
Source-Version: 24-1
Done: Christoph Biedl <[email protected]>
We believe that the bug you reported is fixed in the latest version of
clevis, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christoph Biedl <[email protected]> (supplier of updated clevis
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 18 Oct 2026 21:38:22 +0200
Source: clevis
Architecture: source
Version: 24-1
Distribution: unstable
Urgency: high
Maintainer: Christoph Biedl <[email protected]>
Changed-By: Christoph Biedl <[email protected]>
Closes: 1150905
Changes:
clevis (24-1) unstable; urgency=high
.
* New upstream version 24. Closes: #1150905
Fixes: [CVE-2026-109968] [CVE-2026-109969] [CVE-2026-109970]
[CVE-2026-109971] [CVE-2026-109976]
Checksums-Sha1:
bc87e7f1363976c9548f9d6d9d64d8f863dbd98d 2633 clevis_24-1.dsc
79cfd7f4aa8473cb13c705c11e915861a3fafdc4 143070 clevis_24.orig.tar.gz
14f97fcc0347d9d922f5fe51e3b9ee2650249ce8 9908 clevis_24-1.debian.tar.xz
3800b1c0ed0ba7bf4abe4be1f481adc1d4f0b7e4 13301 clevis_24-1_powerpc.buildinfo
Checksums-Sha256:
335521e3a630a77fbfa9d7bc2f426413a8feadba37f1e72b6fd4705ab96568ad 2633
clevis_24-1.dsc
8b09fdb18716d4f92e2c2fff743bf531bbd85c7f2dc724f863a2e8d8325d74ec 143070
clevis_24.orig.tar.gz
3d95b60f8c0942a5daa9a80d25f5a84c24c43d8cf6f61111c1ccbce3eb7ecd44 9908
clevis_24-1.debian.tar.xz
f3c5cf7f3cb861c2bace8618347e283283cfead0c1e96234ebcf910039784456 13301
clevis_24-1_powerpc.buildinfo
Files:
0faf35e5f99dca6de4750e39f66542a1 2633 net optional clevis_24-1.dsc
90f8b7b600d7d5804b5f04eaaf9bd543 143070 net optional clevis_24.orig.tar.gz
7a227d6779f995d0a2e66e342920ec07 9908 net optional clevis_24-1.debian.tar.xz
7fc26b99d067620d6af06ebe61eb30e1 13301 net optional
clevis_24-1_powerpc.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEWXMI+726A12MfJXdxCxY61kUkv0FAmrXESMACgkQxCxY61kU
kv0yjxAAqEHNWst5LDEcDYg3sBMRkRHzdEbdfVoEZUWMKCdF2kzkZNQ48Ot3xXg3
ZECPIcrRa/GGc4v6ufk/YDwHx51Zvl8Zy/SIBm+Qf7WI77O/OJ5dfl7ea1SAeNa7
m82gS/eLa+HWddj5OkIPwgG+wWxB0WyBGVheqPFxJUhJFlShmnsGMUbKwBBPrpXT
IMbb25Ub6OUgyoM4Z+YxTKkm4mrlRxeAY5uhO8MyIGmijBq1v5zxYVeJhvUI0Gft
F3boCDCGTbQNkoJiNxfwOw87IhsnTR15iyoOf7/8gpBkt5p5Q9AGuQ6xfSR4TrW2
1r1CF9pDNqaM/MACfCRI59Y464BDigOE+qFHfzqjIVTxsgYUtGKJ7s04nmNC0cUp
PyInUVKWlWtjtTWuxTRamuS3HBlqOSBEEqtvpX9ZSjeAu8DDQTJRZmZ7oQ4Zsyx3
eloo+cxvJ2JBfzPzUdZH30cdz+yjvPd9uTG0nUA7F6b3FlYNexBYSLSHngplUIBg
Tb7XUB3hCgmJ+PLbXapmVqCyeNj/0YRfER2WsoAtgXGm8rSS1/vjeCbvwxm+LaAe
1izH3ddSRW2okmx51MEhYEh4Q4DNnlrCl+NW6fQJutz4mnHI1D77FQ3TsmkWYAc1
uvrroJrXsP2QPlXWTFQ70vgXSZFIXpbyJvXuqUuj+xtRKBpSFa4=
=FjPd
-----END PGP SIGNATURE-----
pgp6ZI2mNAXow.pgp
Description: PGP signature
--- End Message ---
