Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-2100 is a medium-severity Access of Uninitialized Pointer (CWE-824) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 35% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-2100 is a vulnerability in p11-kit, a library that facilitates the use of PKCS#11 modules, including support for remote tokens via RPC. The flaw occurs when the C_DeriveKey function is called on a remote token using specific IBM Kyber or IBM BTC derive mechanism parameters set to NULL. This causes the RPC client to attempt returning an uninitialized value, potentially leading to a NULL dereference (CWE-824) or undefined behavior. The issue has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), indicating medium severity primarily affecting availability.
A remote attacker without privileges can exploit this vulnerability over the network with low complexity and no user interaction required. By invoking the vulnerable C_DeriveKey function with the specified NULL parameters on a remote token, the attacker triggers the RPC client's mishandling of uninitialized data, resulting in application-level denial of service or other unpredictable system states.
Red Hat Security Advisory RHSA-2026:7065 addresses this issue, along with details on the CVE page and Bugzilla entry 2437308. A fix is available via pull request #740 in the p11-kit GitHub repository, which security practitioners should apply to mitigate the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16336
Vulnerability Data
A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the…
more
RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover uninitialized pointer accesses through static analysis, dynamic testing, or fuzzing before deployment.
Requiring documented development processes and tools enables use of analyzers or coding standards that identify uninitialized pointer defects.
Security engineering principles can mandate memory-safety practices and language choices that structurally avoid uninitialized pointer use.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent uninitialized pointer bugs via coding standards, analysis, and reviews, but eliminating this single weakness only partially fulfills the broader control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect uninitialized pointer usage before release.
Secure development life cycle mandates practices that reduce uninitialized pointer defects.
Application security requirements can specify pointer initialization rules.
Secure architecture principles discourage unsafe pointer handling.
Secure coding standards directly prohibit use of uninitialized pointers.