CVE-2026-13757: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-13757 is a denial-of-service vulnerability in p11-kit caused by uncontrolled recursion (CWE-674) in its RPC message attribute parsing functions. The functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. Affected software includes p11-kit (all versions with recursive attribute support introduced in commit 6529b540, February 2024), Red Hat Enterprise Linux 6.0–10.0, Red Hat OpenShift Container Platform up to 4.22.1, and Red Hat Hardened Images. The vulnerability was disclosed on June 29, 2026, and carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is uncontrolled recursion (CWE-674) in p11-kit/rpc-message.c, where p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() call each other without any recursion depth bound when encountering attribute array types. Additionally, proto_read_attribute_buffer_array() in p11-kit/rpc-server.c recurses without bound for IS_ATTRIBUTE_ARRAY types. An attacker exploits this by sending a specially crafted C_CreateObject RPC request containing approximately 50,000 levels of nested template attributes (~650 KB of wire data) to the p11-kit Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*), triggering stack exhaustion and a SIGSEGV/SIGBUS crash. No authentication is required beyond same-user access to the Unix domain socket, and the recursive attribute support was introduced without a depth bound in February 2024 (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation results in a denial-of-service condition: the p11-kit server process crashes with a SIGSEGV or SIGBUS signal due to stack exhaustion, and all dependent services are also disrupted. Affected dependent services can include SSH agents, VPN clients, and web browsers that rely on p11-kit for PKCS#11 cryptographic module management. There is no impact on confidentiality or integrity — only availability is affected (Red Hat Bugzilla, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.12%, placing it in the 4th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the p11-kit RPC Unix domain socket, limiting the attack surface to same-user or local processes (Red Hat Bugzilla).

1. Reconnaissance: Identify a target system running a vulnerable version of p11-kit with the RPC server active. Confirm the Unix domain socket exists at /run/user/<uid>/p11-kit/pkcs11-*.
2. Gain local access: Obtain local access to the system as the same user running the p11-kit server (no elevated privileges required).
3. Craft malicious RPC request: Construct a C_CreateObject RPC request containing deeply nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, or CKA_DERIVE_TEMPLATE attributes — approximately 50,000 levels of nesting, resulting in roughly 650 KB of wire data.
4. Send request to socket: Transmit the crafted request to the p11-kit Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*).
5. Trigger stack exhaustion: The recursive parsing functions enter unbounded mutual recursion, exhausting the process stack and causing a SIGSEGV/SIGBUS crash of the p11-kit server process.
6. Achieve denial of service: The p11-kit server and all dependent services (SSH agents, VPN clients, browsers using PKCS#11) are disrupted until the process is restarted (Red Hat Bugzilla).

• Logs: Unexpected termination of the p11-kit server process logged in system journals (e.g., journalctl showing SIGSEGV or SIGBUS for p11-kit-server); systemd service failure events for p11-kit-server.service.
• Process: Sudden crash of p11-kit-server process; dependent processes (SSH agent, VPN client, browser) losing PKCS#11 functionality unexpectedly.
• Network/Socket: Unusual or high-volume connections to the p11-kit Unix domain socket at /run/user/<uid>/p11-kit/pkcs11-* from unexpected local processes.
• File System: Core dump files (e.g., core.*) generated by the p11-kit process in the working directory or configured core dump location, indicating abnormal termination.

Red Hat has released patched RPM packages addressing this vulnerability: p11-kit-0.26.2-1.2.hum1 (via RHSA-2026:37469, issued July 10, 2026) and p11-kit-0.26.4-1.hum1 (via RHSA-2026:38342, issued July 12, 2026) for Red Hat Hardened Images (RHSA-2026:37469, RHSA-2026:38342). Slackware and Fedora have also issued updates for their respective p11-kit packages. As a workaround, restrict local access to the p11-kit RPC Unix domain socket to trusted processes and users only, and monitor for unexpected terminations of p11-kit and dependent services. Upgrading to a patched version is the recommended remediation.

The vulnerability was reported by Red Hat's OSIDB system and tracked via Red Hat Bugzilla. Slackware issued security advisory SSA-2026-191-01 addressing the flaw, and Fedora released an update (fedora-44-p11-kit-2026-695fd36daa). The Yocto Project security mailing list also discussed the issue. Coverage has been limited to standard vulnerability tracking outlets and Linux distribution security channels, with no notable researcher commentary or broader media coverage observed.