The flaw stems from an integer underflow in the getpeername result handling inside the clevis‑pkcs11‑afunix‑socket‑unlock daemon. When an AF_UNIX client connects to the socket without a bound address, the underflow causes a crash of the daemon, which prevents decryption of the LUKS volume during system startup and effectively stops the machine from booting normally. This produces a denial of service that interrupts the boot process.

Red Hat Enterprise Linux 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4 run the clevis‑pkcs11‑afunix‑socket‑unlock service exposed over an AF_UNIX data socket. No specific version numbers are listed; all releases using this service are affected.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Because the data socket is owned by root under standard systemd configuration, exploitation requires local privileged access. Unprivileged users cannot trigger the crash by default, limiting the risk to situations where root privileges can be abused or compromised. The threat remains confined to the affected systems and does not provide a vector for remote exploitation.