QSN-8687-1: p11-kit vulnerabilities
2026-08-27

Summary:
p11-kit could be made to crash if it received specially crafted input.

Details:
It was discovered that p11-kit incorrectly handled certain RPC messages. A
local attacker could use this issue to cause p11-kit to crash, resulting in
a denial of service. (CVE-2026-13757)

It was discovered that p11-kit incorrectly handled nested attribute
decoding on 32-bit systems. A local attacker could use this issue to cause
p11-kit to crash, resulting in a denial of service. (CVE-2026-18938)

Affected QuantaStor releases:
  6.9.1.001 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)
  6.9.0.464 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)
  6.8.6.015 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)
  6.8.5.018 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)
  6.8.4.038 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)
  6.8.3.018 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)
  6.8.2.002 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)
  6.8.1.007 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)
  6.8.0.205 jammy: libp11-kit0 0.24.0-6build1 (fixed in 0.24.0-6ubuntu0.1)

CVEs: CVE-2026-18938, CVE-2026-13757

References:
  https://ubuntu.com/security/notices/USN-8687-1