Hi,

The following vulnerability was published for clevis.

CVE-2026-109976[0]:
| A flaw was found in the clevis PKCS#11 pin. The clevis-
| pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client
| connects to the data socket without a bound address, due to an
| integer underflow in the getpeername result handling. This causes a
| denial of service, preventing LUKS disk decryption from completing
| during boot.

https://bugzilla.redhat.com/show_bug.cgi?id=2550375


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-109976
https://www.cve.org/CVERecord?id=CVE-2026-109976

Please adjust the affected versions in the BTS as needed.

Moritz Mühlenhoff wrote...
not good", I'll take care of these as well:

Subject: Pkcs11: Prevent key material leaking to log file
ID: CVE-2026-109968

Subject: Pkcs11: harden AF_UNIX socket daemon security
ID: CVE-2026-109969

Subject: Pkcs11: restrict PIN file permissions and cleanup
ID: CVE-2026-109970

Subject: Pkcs11: pass PIN via environment variable
ID: CVE-2026-109971

Kind regards,

    Christoph