CVE-2026-109971

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

The PKCS#11 clevis pin is an opt-in feature requiring explicit configuration (clevis luks bind pkcs11), PKCS#11 hardware, and activation of the corresponding systemd service or dracut module. Default clevis installations are not affected.

Red Hat rates this Moderate because the pkcs11-tool process is short-lived and the attacker must catch it during execution. The exposed credential is the PKCS#11 token PIN, not the LUKS passphrase directly, and exploiting the PIN additionally requires physical access to the PKCS#11 token.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No end-user mitigation is available for this issue. The PIN exposure occurs in the clevis-decrypt-pkcs11 script itself, which must be updated to pass the PIN through an environment variable instead of the command line.