The vulnerability CVE-2026-42014 in GnuTLS involves a use-after-free condition triggered by the gnutls_pkcs11_token_set_pin function when an attacker attempts to change the Security Officer PIN with a NULL old PIN on tokens without a protected authentication path. This can lead to memory corruption and denial of service. Red Hat has released security advisories RHSA-2026:20611 and RHSA-2026:20612 providing updated GnuTLS packages for Red Hat Enterprise Linux 8 and 9 that fix this and other related vulnerabilities. The advisories recommend updating to the fixed versions to mitigate the risk. Although the advisories do not explicitly mention Red Hat Enterprise Linux 10, the vulnerability is reported for that product. The CVSS 3.1 base score is 6.6 (medium severity) with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality and integrity impact, and high availability impact.

Successful exploitation of this vulnerability can result in use-after-free memory corruption, which may lead to denial of service or other unintended behavior affecting the availability of the system. Confidentiality and integrity impacts are rated low. There are no known exploits in the wild at this time.

Red Hat has released updated GnuTLS packages that address CVE-2026-42014 along with other related vulnerabilities. Users should apply the security updates provided in Red Hat advisories RHSA-2026:20611 and RHSA-2026:20612 for Red Hat Enterprise Linux 8 and 9. For Red Hat Enterprise Linux 10, check the vendor advisory for the availability of patches or updates. Before applying updates, ensure all previously released errata relevant to your system have been applied. Patch status for Red Hat Enterprise Linux 10 is not explicitly confirmed in the advisory; verify current remediation guidance from Red Hat.