Conrol: tags 1150905 confirmed pending Moritz Mühlenhoff wrote...
> CVE-2026-109976[0]: > | A flaw was found in the clevis PKCS#11 pin. The clevis- > | pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client > | connects to the data socket without a bound address, due to an > | integer underflow in the getpeername result handling. This causes a > | denial of service, preventing LUKS disk decryption from completing > | during boot. > > https://bugzilla.redhat.com/show_bug.cgi?id=2550375 Aye. There's a bunch of more CVE numbers that are at least a "Uh, that's not good", I'll take care of these as well: Subject: Pkcs11: Prevent key material leaking to log file ID: CVE-2026-109968 Subject: Pkcs11: harden AF_UNIX socket daemon security ID: CVE-2026-109969 Subject: Pkcs11: restrict PIN file permissions and cleanup ID: CVE-2026-109970 Subject: Pkcs11: pass PIN via environment variable ID: CVE-2026-109971 Kind regards, Christoph
signature.asc
Description: PGP signature
