CVE-2026-13757

Summary

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:0.26.4-1.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 90:0.26.4-1.el9_8 < *unaffected
Red HatRed Hat Enterprise Linux 90:0.26.4-1.el9_8 < *unaffected
Red HatRed Hat Discovery 21786638573 < *unaffected
Red HatRed Hat Discovery 21786634825 < *unaffected
Red HatRed Hat Hardened Images0.26.2-1.2.hum1 < *unaffected
Red HatRed Hat Hardened Images0.26.4-1.hum1 < *unaffected
Red HatRed Hat Insights proxy 1.51786433656 < *unaffected
Red HatRed Hat Update Infrastructure 51786435241 < *unaffected
Red HatRed Hat Update Infrastructure 51786533457 < *unaffected
Red HatRed Hat Update Infrastructure 51786533449 < *unaffected
Red HatRed Hat Update Infrastructure 51786435483 < *unaffected
Red HatRed Hat Update Infrastructure 51786533529 < *unaffected

Weaknesses

  • CWE-674: Uncontrolled Recursion

Workarounds

This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication.

If p11-kit is managed via systemd –user, ensure Restart=on-failure is set in the unit file so that a crash is automatically recovered without manual intervention.

Red Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References