CVE-2026-109976

4.7Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.7Medium

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-787

Impact

A local attacker with access to the AF_UNIX data socket can crash the unlock daemon and block LUKS disk decryption during boot. This results in a local denial of service.

Root cause

An integer underflow occurs when handling the getpeername result if an AF_UNIX client connects without a bound address.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade the clevis PKCS#11 pin packages once an errata release is published; interim workarounds are not documented in the advisory.

shell

$ sudo dnf update clevis

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109976