Moderate Vulnerability in p11-kit: NULL Dereference via C_DeriveKey
Summary
ALSA-2026:18143: Moderate: p11-kit security update. Affects p11-kit versions < 0.26.2-1.el10. Fixed in 0.26.2-1.el10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The p11-kit package is a crucial component in managing PKCS#11 modules, which are used for cryptographic operations in various applications. It includes the p11-kit-trust subpackage, which manages certificate anchors and blacklists based on configuration files. This functionality is essential for maintaining secure communications and data integrity in software that relies on cryptographic services.
Vulnerability Detail
The vulnerability identified as CVE-2026-2100 involves a NULL dereference that occurs when the C_DeriveKey function is called with specific NULL parameters. This flaw can lead to application crashes or unexpected behavior, potentially exposing sensitive information or allowing unauthorized access. The issue arises from improper handling of input parameters, which can be exploited by an attacker to disrupt the normal operation of applications that utilize the p11-kit library.
How To Fix
Minimum fixed version
0.26.2-1.el10
This is the first release that contains the fix.
sudo dnf update p11-kitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the C_DeriveKey function with NULL parameters until the package is updated. This may involve modifying the application code to ensure that valid parameters are always passed to this function.
Conclusion
The p11-kit package has a moderate vulnerability (CVE-2026-2100) that can lead to application crashes due to a NULL dereference. It is crucial to update to the patched version 0.26.2-1.el10 to mitigate this risk. Users are encouraged to check their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for p11-kit →
FAQ
CVE-2026-2100 is a vulnerability in the p11-kit package that allows for a NULL dereference when specific NULL parameters are passed to the C_DeriveKey function.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to application crashes, unexpected behavior, and potential exposure of sensitive information.
You can update the p11-kit package by running 'sudo dnf update p11-kit' in your terminal, ensuring all related packages are also updated.
Yes, you can avoid using the C_DeriveKey function with NULL parameters as a temporary workaround until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for p11-kit.
