CVE-2026-109969: Clevis PKCS#11 Privilege Escalation Flaw

CVE-2026-109969 Overview

A flaw in the Clevis PKCS#11 pin exposes LUKS passphrases to local users on affected Linux systems. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device or key pairs. The same weakness allows a local user to connect to the data socket and receive LUKS passphrases intended for disk unlock operations. The issue is tracked under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Local attackers can retrieve LUKS passphrases or inject attacker-controlled device/key pairs through unauthenticated AF_UNIX sockets, undermining disk encryption trust boundaries.

Affected Products

Clevis PKCS#11 pin (clevis-pkcs11-afunix-socket-unlock daemon)
Red Hat distributions shipping the affected Clevis component (see Red Hat advisory)
Linux systems using Clevis for automated LUKS unlock via PKCS#11

Discovery Timeline

2026-10-14 - CVE CVE-2026-109969 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109969

Vulnerability Analysis

Clevis is a pluggable framework for automated decryption, commonly used to unlock LUKS volumes at boot. The PKCS#11 pin introduces a helper daemon, clevis-pkcs11-afunix-socket-unlock, that brokers unlock requests over two AF_UNIX sockets. One socket accepts control commands that register device and key pairs. The other socket returns the LUKS passphrase derived through the PKCS#11 token.

The daemon creates these sockets without setting restrictive file-mode permissions and without verifying peer credentials via SO_PEERCRED or similar mechanisms. When the daemon runs under a permissive umask, the socket inodes inherit world-accessible permissions. Any local user who can reach the socket path can therefore talk to the daemon as if they were an authorized component.

Successful interaction with the control socket allows an attacker to associate attacker-chosen key material with a device. Interaction with the data socket allows the attacker to receive passphrase material intended only for the unlock pipeline. The result is unauthorized disclosure of LUKS passphrases and manipulation of the unlock configuration.

Root Cause

The root cause is missing authentication on an IPC endpoint that transmits security-critical secrets. The daemon relies on filesystem permissions that are not explicitly enforced in code. It also omits peer credential verification, so even non-privileged processes satisfy its implicit trust model.

Attack Vector

Exploitation requires local access and low privileges, and depends on a permissive process umask at the time the sockets are created. An attacker with a shell on the host connects to the AF_UNIX socket paths and issues control messages or reads passphrase responses. No user interaction is required.

No verified public exploit code is available. See the Red Hat CVE-2026-109969 Advisory and Red Hat Bug Report #2550361 for upstream analysis.

Detection Methods for CVE-2026-109969

Indicators of Compromise

Unexpected connections to the clevis-pkcs11-afunix-socket-unlock control or data sockets from processes other than the legitimate unlock client.
AF_UNIX socket inodes owned by the daemon with world-readable or world-writable permissions.
Unexplained modifications to Clevis device/key associations managed by the daemon.

Detection Strategies

Audit the socket file permissions created by clevis-pkcs11-afunix-socket-unlock and confirm they are restricted to the intended service account.
Enable Linux audit rules on the socket paths to log connect, read, and write syscalls from unexpected UIDs.
Correlate process execution telemetry with socket activity to identify unauthorized local processes interacting with the daemon.

Monitoring Recommendations

Monitor for process launches of unprivileged binaries that open the Clevis AF_UNIX socket paths.
Alert on changes to the service unit or umask configuration for the Clevis daemon.
Track read access to files containing LUKS key metadata outside of boot-time unlock windows.

How to Mitigate CVE-2026-109969

Immediate Actions Required

Apply vendor updates for the Clevis PKCS#11 pin as soon as they are published by your distribution.
Restrict shell and console access on hosts that use Clevis PKCS#11 unlock to trusted administrators only.
Verify that the daemon's socket files are not world-accessible and tighten permissions where necessary.

Patch Information

Refer to the Red Hat CVE-2026-109969 Advisory for fixed package versions and errata. Track upstream Clevis releases for the corrected socket permission handling and peer credential checks. Rebuild or re-deploy affected systems once patched packages are available in your repositories.

Workarounds

Set an explicit restrictive umask (for example 0077) in the systemd unit for clevis-pkcs11-afunix-socket-unlock so sockets are created with limited permissions.
Place the socket paths under a directory owned by the service account with mode 0700 to block access by other local users.
Disable the PKCS#11 pin and rely on alternative Clevis pins where PKCS#11 unlock is not strictly required.

bash

# Example systemd drop-in to enforce a restrictive umask
# /etc/systemd/system/clevis-pkcs11-afunix-socket-unlock.service.d/override.conf
[Service]
UMask=0077