P11-kit: null dereference via c_derivekey with specific null parameters

Summary

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Timeline

1. Mar 26, 2026, 8:01 PM UTCCVE published
2. Mar 26, 2026, 8:30 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 14, 2026, 7:24 PM UTCRecord last updated

Affected versions

• p11-glue p11-kit

  fixed in 0.26.2

• p11-kit

  Version range not reported

• p11-kit

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/jetstack-cert-manager-acmesolver-rhel9

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• cert-manager/cert-manager-istio-csr-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-rhel9

  Version range not reported

• cert-manager/cert-manager-operator-bundle

  Version range not reported

• cert-manager/cert-manager-trust-manager-rhel9

  Version range not reported

• costmanagement/costmanagement-metrics-rhel9-operator

  Version range not reported

• p11-kit-main

  Version range not reported

• insights-proxy/insights-proxy-container-rhel9

  Version range not reported

• rhui5/cds-rhel9

  Version range not reported

• rhui5/haproxy-rhel9

  Version range not reported

• rhui5/installer-rhel9

  Version range not reported

• rhui5/rhua-rhel9

  Version range not reported

• rhui5/cds-kubernetes-tp-rhel9

  Version range not reported

• rhui5/installer-tp-rhel9

  Version range not reported

• rhui5/rhua-tp-rhel9

  Version range not reported

• p11-kit

  Version range not reported

• p11-kit

  Version range not reported

• p11-kit

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 19