CVE-2026-2100: P11-kit: null dereference via c_derivekey with specific null parameters

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-26 · updated 2026-10-29
Weakness: CWE-824

Description

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Affected products

P11-Kit Project P11-Kit: before 0.26.2 — fixed in 0.26.2
Redhat Cert-Manager Operator: from 1.17.0 before 1.17.2; from 1.18.0 before 1.18.2; from 1.20.0 before 1.20.1 — fixed in 1.17.2, 1.18.2, 1.20.1
Red Hat Cost Management 4: from 4.0.0 before 4.4.1 — fixed in 4.4.1
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0 (and their updates)
RedHat Hardened Images: all versions
Redhat Insights-Proxy: 1.5.0 (and their updates)
RedHat Update Infrastructure: 5.0 (and their updates)

How to fix

Upgrade to a fixed version: P11-Kit Project P11-Kit 0.26.2; Redhat Cert-Manager Operator 1.17.2, 1.18.2, 1.20.1; Red Hat Cost Management 4 4.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-2100 or the next vulnerability affects your stack