Back Linuxsecurity

Ubuntu 24.04 openCryptoki Important Access Issues USN-8686

Linuxsecurity •LinuxSecurity Advisories • August 27, 2026

Find practical guidance for preventing, investigating, and responding to Linux security problems. Find practical guidance for preventing, investigating, and responding to Linux security problems. _ Review Linux Privileges ×

Several security issues were fixed in openCryptoki. Software Description: - opencryptoki: A PKCS#11 Cryptographic Token Interface Standard implementation. Details: It was discovered that primitive decoders in openCryptoki produced integer underflows when the encoded length was zero. An attacker could possibly use this issue to trigger out-of-bounds reads. (CVE-2026-40253) It was discovered that openCryptoki incorrectly handled symlinks. An attacker in the token-group could possibly use this issue to achieve privilege escalation or access sensitive information. (CVE-2026-23893)

Several security issues were fixed in openCryptoki.

Software Description:

- opencryptoki: A PKCS#11 Cryptographic Token Interface Standard implementation.

It was discovered that primitive decoders in openCryptoki produced integer

underflows when the encoded length was zero. An attacker could possibly use

this issue to trigger out-of-bounds reads. (CVE-2026-40253)

It was discovered that openCryptoki incorrectly handled symlinks. An

attacker in the token-group could possibly use this issue to achieve

privilege escalation or access sensitive information. (CVE-2026-23893)

The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS libopencryptoki-dev 3.23.0+dfsg-0ubuntu3.1 libopencryptoki0 3.23.0+dfsg-0ubuntu3.1 opencryptoki 3.23.0+dfsg-0ubuntu3.1 Ubuntu 22.04 LTS libopencryptoki-dev 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3 libopencryptoki0 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3 opencryptoki 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3 In general, a standard system update will make all the necessary changes.

CVE-2026-23893, CVE-2026-40253

Ubuntu Security Notice USN-8686-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in openCryptoki Affecting Ubuntu Systems Two significant vulnerabilities were discovered in openCryptoki, a PKCS#11 Cryptographic Token Interface implementation. CVE-2026-40253 involves integer underflows that could lead to out-of-bounds reads, while CVE-2026-23893 allows privilege escalation through improper symlink handling. Both vulnerabilities affect Ubuntu 24.04 and 22.04 LTS systems. Attackers in the token-group could exploit these flaws to access sensitive information or escalate privileges. The issues were disclosed on August 27, 2026, and can be mitigated by updating to the latest package versions. A standard system update is recommended for all affected users. The vulnerabilities were published in early 2026, with the first being reported on April 16 and the second on January 22. Immediate action is advised to protect systems from potential exploitation. 3 sources 58

Extracted Entities

Ubuntu 24.04 openCryptoki Important Access Issues USN-8686

The full story

Extracted Entities

Companies (1)

CVEs (2)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)