CVE-2026-109968: Insertion of Sensitive Information into Log File in Red Hat Red Hat Enterprise Linux 10

This vulnerability involves the clevis PKCS#11 pin component in Red Hat Enterprise Linux 10. The clevis-pkcs11-afunix-socket-unlock daemon improperly logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created with permissions that are not restrictive, making it world-readable under the default process umask. As a result, a local attacker with access to the system can read the log file and retrieve the LUKS passphrase, potentially compromising disk encryption confidentiality.

The impact is that a local attacker can obtain LUKS disk encryption passphrases by reading a plaintext log file that is world-readable. This compromises the confidentiality of encrypted disk data but does not affect integrity or availability. The attack requires local access and low complexity, with no user interaction needed.

Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-109968 for current remediation guidance. Until a fix is available, restrict access to the log files and consider adjusting the process umask or logging configuration to prevent sensitive information from being logged in plaintext.