CVE-2026-109976

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.

The PKCS#11 clevis pin is an opt-in feature requiring explicit configuration (clevis luks bind pkcs11), PKCS#11 hardware, and activation of the corresponding systemd service or dracut module. Default clevis installations are not affected.

Red Hat rates this Moderate because under the default systemd UMask of 0022, the data socket is created with mode 0755. AF_UNIX SOCK_STREAM requires write permission to connect, so only root can reach the vulnerable code path. Since the daemon itself runs as root, this does not cross a privilege boundary. The crash is a denial of service only — _FORTIFY_SOURCE and stack canaries independently prevent code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No additional end-user mitigation is needed. Under the default systemd configuration, the data socket is only accessible by root, preventing unprivileged users from triggering the crash.