CVE-2026-109969: Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask

Description

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Local

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.1% · higher than 3% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

RH

Red Hat Enterprise Linux 10 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat Enterprise Linux 7 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat Enterprise Linux 8 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat Enterprise Linux 9 · Red Hat

All versions, or not specified · source: vendor