CVE-2026-18938: p11-kit Integer Overflow DoS Vulnerability

CVE-2026-18938 Overview

A flaw exists in p11-kit that allows a local attacker with access to a reachable RPC channel to trigger memory corruption. The vulnerability stems from an integer overflow when calculating memory allocation for nested attributes during RPC message parsing. Specially crafted messages cause a heap out-of-bounds write, crashing the p11-kit RPC parsing process and producing a Denial of Service (DoS). The issue is only exploitable on 32-bit systems. The weakness is tracked as [CWE-122] (heap-based buffer overflow) and requires local access with no privileges or user interaction.

Critical Impact
Local attackers on 32-bit systems can crash the p11-kit RPC parser by exploiting an integer overflow that leads to a heap out-of-bounds write.

Affected Products

p11-kit (PKCS#11 module management library)
Linux distributions shipping p11-kit on 32-bit architectures
Red Hat products bundling vulnerable p11-kit builds (see Red Hat advisory)

Discovery Timeline

2026-08-07 - CVE CVE-2026-18938 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-18938

Vulnerability Analysis

The vulnerability resides in the p11-kit RPC message parser. When processing nested PKCS#11 attributes, the parser computes a memory allocation size that can overflow a 32-bit integer. The overflowed value produces an undersized heap buffer. Subsequent copies of attribute data then write past the allocated region, corrupting adjacent heap memory.

The out-of-bounds write does not lead to code execution in the reported scope. Instead, it terminates the p11-kit RPC parsing process. Applications relying on p11-kit for smart card, TPM, or software PKCS#11 modules lose cryptographic service availability. Because 64-bit builds use wider arithmetic for the same calculation, the overflow does not manifest on 64-bit systems.

Root Cause

The root cause is unchecked arithmetic during allocation sizing for nested attribute structures. The multiplication of an attribute count by a per-element size can exceed SIZE_MAX on 32-bit platforms, wrapping to a small value. The allocator returns a small buffer, and later serialization logic writes the full unbounded payload into it, producing a heap-based buffer overflow.

Attack Vector

An attacker requires local access or equivalent reach to a p11-kit RPC channel, such as a Unix domain socket used by the p11-kit server. No authentication or user interaction is required to send crafted RPC messages. The attacker submits a message declaring a large number of nested attributes, engineered to trigger the integer overflow. The parsing process then crashes, denying PKCS#11 services to consumers.

The vulnerability manifests in the RPC attribute deserialization path. See the Red Hat CVE-2026-18938 Advisory and Red Hat Bug Report #2478995 for source-level technical details.

Detection Methods for CVE-2026-18938

Indicators of Compromise

Unexpected crashes or termination of the p11-kit or p11-kit-remote process on 32-bit hosts.
Core dumps referencing heap corruption inside p11-kit RPC parsing routines.
Sudden loss of PKCS#11-backed cryptographic operations for dependent applications.

Detection Strategies

Monitor for repeated segmentation faults or SIGABRT events tied to p11-kit processes in journald or syslog.
Alert on abnormal message rates or malformed frames on p11-kit RPC sockets.
Correlate p11-kit crashes with local process activity from unprivileged users using EDR telemetry.

Monitoring Recommendations

Enable systemd core dump collection (systemd-coredump) and forward reports to a central analysis pipeline.
Track p11-kit package versions across 32-bit endpoints to prioritize patching coverage.
Watch for restart loops of services that depend on p11-kit, such as GnuTLS or NSS-backed applications.

How to Mitigate CVE-2026-18938

Immediate Actions Required

Apply vendor-supplied p11-kit updates as they become available from your Linux distribution.
Prioritize remediation on 32-bit systems, which are the only affected platforms.
Restrict local access to p11-kit RPC sockets to trusted users and services only.

Patch Information

Red Hat has published tracking information at the Red Hat CVE-2026-18938 Advisory. Consult your distribution's security tracker for fixed package versions and backports. Rebuild and redeploy any statically linked or bundled p11-kit components after upgrading.

Workarounds

Where feasible, migrate affected workloads to 64-bit builds, which are not exploitable.
Tighten filesystem permissions on p11-kit RPC socket paths to limit which local accounts can connect.
Disable p11-kit-remote on systems that do not require remote PKCS#11 module access.

bash

# Verify installed p11-kit version and architecture
rpm -q p11-kit --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n'

# Update p11-kit on Red Hat based systems
sudo dnf update p11-kit

# Restrict access to the p11-kit RPC socket
sudo chmod 0600 /run/user/$(id -u)/p11-kit/pkcs11