The opencryptoki packages in Red Hat Enterprise Linux 8 implement the PKCS#11 API version 2.11 for IBM cryptographic hardware and software tokens. A vulnerability identified as CVE-2026-40253 allows information disclosure and denial of service through malformed BER-encoded cryptographic objects. The issue affects the Slot Daemon (pkcsslotd) and related utilities. Red Hat has issued a security update (opencryptoki-3.22.0-3.el8_10.3) to fix this vulnerability. The advisory applies to multiple architectures and product variants of Red Hat Enterprise Linux 8 and CodeReady Linux Builder. The vendor rates the security impact as moderate and provides guidance for applying the update.

Successful exploitation of CVE-2026-40253 could lead to information disclosure and denial of service conditions in systems using the opencryptoki package. This affects cryptographic operations involving IBM cryptographic hardware or software tokens that process BER-encoded cryptographic objects. The impact is rated moderate by Red Hat Product Security. There are no known exploits in the wild at this time.

Red Hat has released an official security update for opencryptoki (version 3.22.0-3.el8_10.3) that addresses this vulnerability. Users of affected Red Hat Enterprise Linux 8 and CodeReady Linux Builder products should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the official patch.