# CVE-2026-109976: clevis PKCS#11 pin denial of service in socket handler

Source: https://junglewise.ai/threats/cve-2026-109976-a-flaw-was-found-in-the-clevis-pkcs-11-pin-the-clevis-pkcs11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109976 · Severity: medium · CVSS 4.7 · Published 2026-10-13

The clevis PKCS#11 pin is a security module that helps decrypt LUKS-encrypted disks during system boot. An integer underflow flaw in the socket handler allows the daemon to crash when processing certain client connections, which blocks disk decryption and prevents the system from booting. The vulnerability requires root access to trigger and cannot lead to code execution.

Technologies: [Red Hat Clevis](https://junglewise.ai/threats/technologies/clevis). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-109976 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109976 being exploited in the wild.

**How severe is CVE-2026-109976?** Medium severity, with a CVSS score of 4.7, published 13 October 2026.

**Which products and versions are affected?** Red Hat Clevis not specified.

**Is there a fix for CVE-2026-109976?** No fixed version is recorded yet. No additional end-user mitigation is needed. Under the default systemd configuration with umask 0022, the data socket is created with mode 0755 and is only accessible by root, preventing unprivileged users from triggering the crash. The PKCS#11 clevis pin is opt-in and requires explicit configuration.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-13"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109976 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-109976?** Check whether you run Red Hat Clevis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


No additional end-user mitigation is needed. Under the default systemd configuration with umask 0022, the data socket is created with mode 0755 and is only accessible by root, preventing unprivileged users from triggering the crash. The PKCS#11 clevis pin is opt-in and requires explicit configuration.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-13"}]

## Technical details

An integer underflow occurs in the clevis-pkcs11-afunix-socket-unlock daemon's getpeername result handling when an AF_UNIX client connects to the data socket without a bound address, triggering a crash and denial of service. The attack is local only and requires privileges Low (root can write to the socket); the flaw prevents LUKS disk decryption during boot. No code execution is possible due to FORTIFY_SOURCE and stack canaries.

## Affected products

- Red Hat clevis not specified

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-109976](https://access.redhat.com/security/cve/CVE-2026-109976)

## Related threats

- [Clevis PKCS#11 pin credential exposure on command line](https://junglewise.ai/threats/cve-2026-109971-a-flaw-was-found-in-the-clevis-pkcs-11-pin-the-clevis-decrypt)