CVE-2026-109976

Timeline

Detection, updates, and resolution for this record.

1. Oct 13, 2026 · OSV.dev

   Detected

   A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.

2. Oct 14, 2026 · OSV.dev

   Updated

   A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.

3. Oct 14, 2026 · NIST NVD

   Updated

   A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.

Affected

• Debian:12 clevis19-2, 19-3, 19-4
• Debian:13 clevis20-1, 22-1, 23-1
• Debian:14 clevis20-1, 22-1, 23-1

Sources

• CVE.orgCVE-2026-109976

  Official CVE identifier

  cve.org
• NIST NVDCVE-2026-109976

  A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventin

  nvd.nist.gov
• OSV.devDEBIAN-CVE-2026-109976
  osv.dev

References

• Reference · access.redhat.com
• Reference · bugzilla.redhat.com
• ADVISORY · security-tracker.debian.org