CVE-2026-13757 is a vulnerability in the p11-kit package, specifically in the RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value(). These functions form a mutually-recursive call chain without a recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. The vulnerability requires same-user access to the Unix domain socket and does not require further authentication. Red Hat recommends updating to p11-kit version 0.26.3 or later, which implements a recursion depth limit to mitigate this issue.

The vulnerability allows an unauthenticated local attacker with access to the p11-kit RPC Unix domain socket to cause a denial of service by crashing the p11-kit server process through stack exhaustion. This crash also affects dependent services such as SSH agents, VPN clients, and browsers, potentially disrupting normal operations. There is no impact on confidentiality or integrity reported. The attack complexity is low, and no privileges or user interaction are required beyond local same-user socket access.

Red Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this vulnerability. If p11-kit is managed via systemd --user, ensure the unit file has 'Restart=on-failure' set to automatically recover from crashes. Since the vulnerability requires same-user access to the Unix domain socket, restricting access to this socket can reduce risk. Patch status is confirmed as fixed in version 0.26.3 and later.