CVE-2026-109970: Clevis PKCS#11 PIN Information Disclosure

CVE-2026-109970 Overview

CVE-2026-109970 is an information disclosure flaw in the clevis PKCS#11 pin component. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without applying restrictive permissions. Under the default process umask, the resulting file is world-readable by any local user. The script also fails to reliably remove the PIN file when the decryption process exits early, leaving sensitive credential material on disk indefinitely. The weakness is classified as [CWE-538] (Insertion of Sensitive Information into Externally-Accessible File or Directory).

Critical Impact
Any local user on an affected system can read the plaintext PKCS#11 token PIN, enabling unauthorized access to LUKS-encrypted volumes protected by the token.

Affected Products

Clevis automated encryption framework (PKCS#11 pin component)
Red Hat distributions shipping the clevis-luks-pkcs11-askpin script
Systems using Clevis PKCS#11 pin for LUKS automated unlocking

Discovery Timeline

2026-10-14 - CVE CVE-2026-109970 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109970

Vulnerability Analysis

The clevis-luks-pkcs11-askpin helper script collects a PKCS#11 token PIN and persists it to a temporary file so downstream decryption steps can consume it. The script does not call chmod or umask to constrain file permissions before writing the PIN. On systems with the default umask of 0022, the file is created with mode 0644, making it readable by every local account.

The second defect is incomplete cleanup. If the decryption workflow exits early due to an error, signal, or interrupted boot path, the PIN file is not removed. The plaintext credential remains on disk until a user manually deletes it or the filesystem is wiped.

Exploitation requires only local shell access. Any unprivileged user who enumerates the predictable file path can read the PIN and use it to unlock LUKS volumes bound to the PKCS#11 token.

Root Cause

The root cause is improper file permission handling combined with missing cleanup logic in a shell script. The script trusts the ambient process umask instead of explicitly restricting the PIN file to mode 0600 and the owning user. There is no trap handler to remove the PIN file on abnormal exit.

Attack Vector

The attack vector is local. An attacker with a non-privileged shell on the target system enumerates known temporary paths used by Clevis, reads the plaintext PIN, and uses it to decrypt any LUKS volume bound to the corresponding PKCS#11 token. No user interaction is required, and the attack succeeds without elevated privileges.

The vulnerability mechanism is described in the Red Hat CVE-2026-109970 advisory and tracked in Red Hat Bug Report #2550362. No proof-of-concept code is required beyond standard file read operations.

Detection Methods for CVE-2026-109970

Indicators of Compromise

Presence of residual PIN files in temporary directories used by clevis-luks-pkcs11-askpin after a failed or interrupted boot
Files containing PKCS#11 PIN material with world-readable permissions (0644 or broader)
Unexpected read access by non-root users to Clevis working directories

Detection Strategies

Audit the filesystem for files created by clevis-luks-pkcs11-askpin and verify their permissions and ownership
Enable Linux audit framework (auditd) rules on Clevis temporary paths to log read access by non-owner users
Review shell command history and process accounting for unexpected invocations of clevis-luks-pkcs11-askpin

Monitoring Recommendations

Monitor file creation events in /tmp, /run, and other temporary paths used by the Clevis workflow
Alert on read syscalls against Clevis PIN files by any UID other than root or the Clevis service account
Track process exits of Clevis decryption scripts and correlate with cleanup of associated temporary files

How to Mitigate CVE-2026-109970

Immediate Actions Required

Apply the vendor patch from Red Hat as soon as it is available for your distribution
Audit affected hosts for residual plaintext PIN files and securely delete any found
Rotate PKCS#11 token PINs on systems that may have exposed them before remediation
Restrict local shell access on systems running Clevis PKCS#11 unlocking

Patch Information

Refer to the Red Hat CVE-2026-109970 advisory for the current patch status and affected package versions. Apply updates to the clevis package through your distribution's package manager once fixes are published. Track remediation progress through Red Hat Bug Report #2550362.

Workarounds

Set a restrictive umask such as 0077 for the service or boot context that invokes clevis-luks-pkcs11-askpin
Wrap the script invocation with a trap handler that securely removes the PIN file on any exit condition
Store Clevis temporary files on a directory restricted to the root user, such as a private tmpfs mount with mode 0700
Limit local user access on hosts where Clevis is used until the patched package is installed

bash

# Configuration example
# Enforce restrictive umask before invoking Clevis PKCS#11 unlock
umask 0077

# Restrict Clevis temporary directory to root only
install -d -m 0700 -o root -g root /run/clevis

# Audit rule to detect reads of Clevis PIN files
auditctl -w /run/clevis -p r -k clevis_pin_access