CVE-2026-13757: p11-kit RPC Stack Exhaustion Denial-of-Service

Technical summary

The vulnerability exists in the RPC message parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() within p11-kit. These functions form a mutually-recursive call chain when processing CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. The functions lack recursion depth limits, allowing an attacker to send specially crafted RPC requests with nested template attributes at depths that exhaust the stack. The resulting stack overflow crashes the p11-kit server process. This is classified as a CWE-674 (Uncontrolled Recursion) flaw.

Business impact

Services dependent on p11-kit for cryptographic operations—including OpenShift Container Platform, Enterprise Linux systems, and applications using p11-kit for key management—become unavailable when the p11-kit server is crashed. In containerized and production environments, repeated denial-of-service attacks could cause service interruptions and require manual restarts. The impact is limited to availability; confidentiality and integrity of cryptographic material remain unaffected. Organizations running p11-kit should assess the criticality of their use cases and ensure recovery procedures are in place.

Affected systems

This vulnerability affects p11-kit and products that integrate it, including Red Hat Enterprise Linux (all recent supported versions), Red Hat OpenShift Container Platform, and Red Hat Hardened Container Images. Any system or service that exposes the p11-kit RPC Unix domain socket is at risk if it permits local user access or if the socket permissions are misconfigured.

Exploitability

Exploitation requires local access to the p11-kit RPC Unix domain socket, meaning the attacker must have a user account on the affected system or container. No authentication is required once local access is achieved. The attack is trivial to execute—sending a crafted nested-attribute RPC message requires no special privileges or tools beyond standard socket communication. However, the local-access requirement significantly reduces the attack surface for internet-facing systems. Containerized deployments with multi-tenant or untrusted user bases face higher risk.

Remediation

Apply security updates from your vendor as soon as they become available. Red Hat users should monitor their respective Enterprise Linux, OpenShift, and container image advisories for patch releases that address CVE-2026-13757. Ensure p11-kit RPC Unix domain socket permissions restrict access to trusted users only. Review and harden local access controls to p11-kit sockets, particularly in multi-user or containerized environments. Implement service monitoring and auto-restart mechanisms to detect and recover from p11-kit crashes.

Patch guidance

Monitor Red Hat Security Advisories and the p11-kit project's official release channels for patched versions. When patches are released, test them in a non-production environment before deployment. Prioritize patching systems that expose p11-kit sockets to multiple local users or untrusted contexts. Container image updates should be pulled from official repositories and rebuilt into your deployment pipelines. Verify patch application by confirming the RPC parsing functions implement recursion depth checks.

Detection guidance

Monitor for unexpected p11-kit process crashes, particularly if correlated with anomalous RPC traffic patterns. Log local socket access attempts to p11-kit sockets and flag failed RPC calls with deeply nested attributes. Implement process-level monitoring to detect repeated crashes and restarts of p11-kit. Host-based intrusion detection may flag suspicious RPC message patterns, though signature-based detection is challenging without vendor-specific rules. Collect and review dmesg or kernel logs for stack overflow messages related to p11-kit.

Why prioritize this

Although the CVSS score is medium (6.2) and exploitation requires local access, the flaw affects foundational cryptographic infrastructure used across Red Hat Enterprise Linux and OpenShift ecosystems. A successful attack causes service unavailability rather than data breach, but in production environments with strict uptime requirements, even local denial-of-service can be operationally significant. Prioritize patching based on the sensitivity of local user populations and the criticality of dependent services.

Risk score, explained

The CVSS 3.1 score of 6.2 (MEDIUM) reflects the attack vector (local), no privileges required, and high impact on availability (AH). The attack does not compromise confidentiality or integrity, and the local-access requirement prevents remote exploitation. The score appropriately balances the severity of a denial-of-service condition in foundational infrastructure against the practical barrier of needing valid local access.

Frequently asked questions