Review reviewHigh

CVE-2026-2100

p11-glue p11-kit, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

CVSS: 7.5
EPSS: 1.16%
CISA KEV: Not listed
Published: 2026.03.27

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability1.16%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: p11-glue p11-kit, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9
Affected versions: < 0.26.2, 9.0, 10.0
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that p11-glue p11-kit, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-824