The p11-kit package contains a vulnerability (CVE-2026-2100) where invoking the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL can lead to a NULL dereference or undefined behavior. This results from the RPC client attempting to return an uninitialized value, potentially causing an application-level denial of service or unpredictable system states. The flaw affects certain versions of Red Hat Enterprise Linux (9.8 and 10.2), Fedora (42 and 43), and Red Hat In-Vehicle OS 2.0. Other Red Hat products, including OpenShift Container Platform, are not affected as they do not include the vulnerable code. The vulnerability is tracked under CWE-824 (Access of Uninitialized Pointer) and related CWEs. Red Hat has issued a security advisory (RHSA-2026:27998) with updates to address this issue.

Exploitation of this vulnerability can cause an application-level denial of service or unpredictable system states due to a NULL pointer dereference. There is no impact on confidentiality or integrity. The CVSS v3.1 base score assigned by Red Hat is 5.3 (medium severity), reflecting a network attack vector with low complexity and no required privileges or user interaction. The vulnerability does not allow code execution or data disclosure but may cause crashes or instability in affected applications.

Red Hat has released security updates to fix this vulnerability. Users should apply the relevant updates for their affected products, specifically Red Hat Enterprise Linux 9.8 and 10.2, Fedora 42 and 43, and Red Hat In-Vehicle OS 2.0. No other effective mitigations are currently available or meet Red Hat's criteria for deployment. Applying the official patches is the recommended remediation.