The vulnerability in p11-kit allows a remote attacker to exploit the C_DeriveKey function on a remote token by passing specific IBM kyber or IBM btc derive mechanism parameters as NULL. This triggers the RPC-client to attempt returning an uninitialized pointer, which can cause a NULL dereference or undefined behavior. The impact is primarily an application-level denial of service or unpredictable system behavior. The CVSS score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. Red Hat Hardened Images RPMs are affected. Vendor advisories exist but do not explicitly confirm a patch or fix in the provided text.

The vulnerability can cause application-level denial of service or unpredictable system states due to NULL pointer dereference or undefined behavior when the C_DeriveKey function is called with crafted NULL parameters. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisories at https://access.redhat.com/errata/RHSA-2026:7065 and https://access.redhat.com/security/cve/CVE-2026-2100 for current remediation guidance. The advisories mention an update for Red Hat Hardened Images RPMs but do not explicitly confirm a fix for this CVE in the provided content. Users should monitor these advisories and apply updates as they become available.