CVE-2026-23893: 
NixOS vulnerability analysis and mitigation

CVE-2026-23893 is a symlink-following (link following) vulnerability in openCryptoki, a PKCS#11 library for Linux and AIX. All versions from v2.3.2 onward are affected, spanning multiple components including the base token directory file access code, pkcstok_admin, pkcstok_migrate, pkcshsm_mk_change, pkcsicsf, and the ICSF token. The vulnerability was published on January 22, 2026, and is fixed in commit 5e6e4b4 and the official release v3.27.0. It carries a CVSS v3.1 base score of 6.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-59 (Improper Link Resolution Before File Access — 'Link Following'). Token and lock directories are configured with 0770 permissions (group-writable for token users), allowing any token-group member to plant files and symlinks within them. The vulnerable code paths use stat()/chmod()/chown() without lstat(), or fopen() without the O_NOFOLLOW flag followed by fchmod()/fchown(), meaning they will transparently follow attacker-controlled symlinks and apply ownership or permission changes to the symlink target rather than the intended file. The fix introduces a fopen_nofollow() helper using open(O_NOFOLLOW) + fdopen() on platforms that support it, and an lstat()-based fallback elsewhere; pkcstok_admin was additionally updated to use lstat() and skip non-regular files (GitHub Commit, GitHub Advisory).

A successful exploit allows a token-group member to redirect privileged file operations (ownership and permission resets performed as root) to arbitrary filesystem targets such as /etc/shadow or /etc/passwd, enabling privilege escalation or sensitive data exposure. The confidentiality and integrity impacts are rated High, as an attacker can gain read/write access to protected system files; availability impact is Low. Exploitation requires local access, low privileges (token-group membership), and user interaction (an administrator must run a PKCS#11 application or administrative tool during normal maintenance) (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication (Feedly). The EPSS score is approximately 0.015% (0.000150), indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local token-group membership and administrator interaction, limiting the realistic attacker pool to insiders or users who have already obtained token-group access.

1. Gain token-group membership: Obtain membership in the token group (e.g., pkcs11) on the target system through legitimate access, social engineering, or a prior compromise.
2. Identify the token directory: Locate the group-writable token directory (typically under /var/lib/opencryptoki/<token>/ or similar), which is configured with 0770 permissions.
3. Plant a symlink: Inside the writable token directory, create a symlink pointing to a sensitive system file — for example: ln -s /etc/shadow <token_dir>/NVDAT.TOK or target another file that openCryptoki tools are known to chown/chmod.
4. Wait for administrator action: Wait for a root-privileged administrator to run a PKCS#11 application or an openCryptoki administrative tool (e.g., pkcstok_admin chown, pkcstok_migrate, or pkcshsm_mk_change) that performs file permission/ownership operations inside the token directory during routine maintenance.
5. Achieve privilege escalation or data exposure: The tool follows the planted symlink and applies chown/chmod to the symlink target (e.g., /etc/shadow), potentially granting the attacker's group read/write access to that sensitive file, enabling further privilege escalation or credential theft (GitHub Advisory, GitHub Commit).

• File System: Unexpected symlinks inside token directories (e.g., /var/lib/opencryptoki/<token>/) pointing to system files such as /etc/shadow, /etc/passwd, or other sensitive paths.
• File System: Unusual ownership or permission changes on system files (e.g., /etc/shadow becoming group-readable by the pkcs11 group) not attributable to normal administrative activity.
• Logs: openCryptoki trace/error logs containing messages such as "Refusing to follow symlink" (on patched versions) or unexpected fopen errors in loadsave.c, pkcstok_admin, pkcstok_migrate, or hsm_mk_change.c components.
• Logs: System audit logs (auditd) showing chown or chmod syscalls by root-owned openCryptoki processes targeting files outside the expected token directory tree.
• Process: Administrative openCryptoki tools (pkcstok_admin, pkcstok_migrate, pkcshsm_mk_change) executing with root privileges at unusual times or triggered by non-standard users.

Upgrade openCryptoki to v3.27.0 or apply commit 5e6e4b42f2b1fcc1e4ef1b920e463bfa55da8b45 from the upstream repository. Red Hat has issued patches for affected RHEL versions: RHSA-2026:4717 (RHEL 10), RHSA-2026:5587 (RHEL 8), RHSA-2026:5603 (RHEL 9), RHSA-2026:5917 (RHEL 10.0 EUS), RHSA-2026:5919 (RHEL 9.6 EUS), and RHSA-2026:6006 (RHEL 9.4 EUS). SUSE and openSUSE have also released updated packages. As interim workarounds: restrict token-group membership strictly to trusted users, apply the principle of least privilege for administrative operations, and audit token directory contents for unexpected symlinks before running privileged openCryptoki tools (Red Hat Bugzilla, GitHub Advisory).

The vulnerability was reported by Pavel Kohout of Aisle Research and disclosed via the GitHub Security Advisory on January 20, 2026. Red Hat tracked it via Bugzilla and issued multiple errata across RHEL 8, 9, and 10 product lines. SUSE and openSUSE also published security updates. German Linux security outlet pro-linux.de covered the issue across multiple advisories. No significant broader social media or researcher commentary beyond standard advisory coverage has been observed (GitHub Advisory, Red Hat Bugzilla).