# CVE-2026-40253: libopencryptoki0: openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX

CVE-2026-40253 is fixed in 11 products on 1 platform, first by libopencryptoki0 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3, released April 16, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-40253
- Priority: Routine
- CVSS: 6.8 (Medium)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 16, 2026

## Description

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library (asn1.c) accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them against actual buffer boundaries. All primitive decoders are affected: ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE. Additionally, ber_decode_INTEGER can produce integer underflows when the encoded length is zero. An attacker supplying a malformed BER-encoded cryptographic object through PKCS#11 operations such as C_CreateObject or C_UnwrapKey, token loading from disk, or remote backend communication can trigger out-of-bounds reads. This affects all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code is in the shared common library. A patch is available thorugh commit ed378f463ef73364c89feb0fc923f4dc867332a3.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libopencryptoki0 Ubuntu 22.04.1 LTS (jammy) | 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3 | [libopencryptoki0 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopencryptoki0-3.17.0-dfsg-20220202.b40982e-0ubuntu1.3.md) | Apr 16, 2026 |
| Linux | libopencryptoki0 Ubuntu 24.04.5 LTS (noble) | 3.23.0+dfsg-0ubuntu3.1 | [libopencryptoki0 3.23.0+dfsg-0ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libopencryptoki0-3.23.0-dfsg-0ubuntu3.1.md) | Apr 16, 2026 |
| Linux | libopencryptoki0 Ubuntu 26.04.1 LTS (resolute) | 3.26.0+dfsg-0ubuntu1.1 | [libopencryptoki0 3.26.0+dfsg-0ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libopencryptoki0-3.26.0-dfsg-0ubuntu1.1.md) | Apr 16, 2026 |
| Linux | openCryptoki opensuse-leap 16.0 | 3.27.0-160000.1.1 | [OPENSUSE-SU-2026:21059-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21059-1.md) | Jun 25, 2026 |
| Linux | openCryptoki sles 15.7 | 3.26.0-150700.5.17.1 | [SUSE-SU-2026:2757-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2757-1.md) | Jul 3, 2026 |
| Linux | openCryptoki sles 16.0 | 3.27.0-160000.1.1 | [SUSE-SU-2026:22365-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22365-1.md) | Jun 25, 2026 |
| Linux | opencryptoki Debian 13.5 (trixie) | 3.23.0+dfsg-0.3+deb13u1 | [DEBIAN-CVE-2026-40253](https://patchblox.com/security/data/fix/linux/debian-cve-2026-40253.md) | Apr 16, 2026 |
| Linux | opencryptoki Debian 14 | 3.27.0-1 | [DEBIAN-CVE-2026-40253](https://patchblox.com/security/data/fix/linux/debian-cve-2026-40253.md) | Apr 16, 2026 |
| Linux | opencryptoki RHEL 10 | 3.24.0-6.el10_0.2 | [RHSA-2026:36697](https://patchblox.com/security/data/fix/linux/rhsa-2026-36697.md) | Apr 16, 2026 |
| Linux | opencryptoki RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki RHEL 9 | 0:3.26.0-2.el9_8.2 | [RHSA-2026:28256](https://patchblox.com/security/data/fix/linux/rhsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki Ubuntu 22.04.1 LTS (jammy) | 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3 | [opencryptoki 3.17.0+dfsg+20220202.b40982e-0ubuntu1.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-opencryptoki-3.17.0-dfsg-20220202.b40982e-0ubuntu1.3.md) | Apr 16, 2026 |
| Linux | opencryptoki Ubuntu 24.04.5 LTS (noble) | 3.23.0+dfsg-0ubuntu3.1 | [opencryptoki 3.23.0+dfsg-0ubuntu3.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-opencryptoki-3.23.0-dfsg-0ubuntu3.1.md) | Apr 16, 2026 |
| Linux | opencryptoki Ubuntu 26.04.1 LTS (resolute) | 3.26.0+dfsg-0ubuntu1.1 | [opencryptoki 3.26.0+dfsg-0ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-opencryptoki-3.26.0-dfsg-0ubuntu1.1.md) | Apr 16, 2026 |
| Linux | opencryptoki almalinux 10 | 3.26.0-3.el10_2.1 | [ALSA-2026:28231](https://patchblox.com/security/data/fix/linux/alsa-2026-28231.md) | Jun 23, 2026 |
| Linux | opencryptoki almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki almalinux 9 | 3.26.0-2.el9_8.2 | [ALSA-2026:28256](https://patchblox.com/security/data/fix/linux/alsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki ol 10 | 0:3.26.0-3.el10_2.1 | [ELSA-2026-28231](https://patchblox.com/security/data/fix/linux/elsa-2026-28231.md) | Jul 16, 2026 |
| Linux | opencryptoki ol 8 | 0:3.22.0-3.el8_10.3 | [ELSA-2026-26352](https://patchblox.com/security/data/fix/linux/elsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki ol 9 | 0:3.26.0-2.el9_8.2 | [ELSA-2026-28256](https://patchblox.com/security/data/fix/linux/elsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki rocky 10 | 0:3.26.0-3.el10_2.1 | [RLSA-2026:28231](https://patchblox.com/security/data/fix/linux/rlsa-2026-28231.md) | Jun 24, 2026 |
| Linux | opencryptoki rocky 8 | 0:3.22.0-3.el8_10.3 | [RLSA-2026:26352](https://patchblox.com/security/data/fix/linux/rlsa-2026-26352.md) | Jun 17, 2026 |
| Linux | opencryptoki rocky 9 | 0:3.26.0-2.el9_8.2 | [RLSA-2026:28256](https://patchblox.com/security/data/fix/linux/rlsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki-ccatok RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki-ccatok RHEL 9 | 0:3.26.0-2.el9_8.2 | [RHSA-2026:28256](https://patchblox.com/security/data/fix/linux/rhsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki-ccatok almalinux 10 | 3.26.0-3.el10_2.1 | [ALSA-2026:28231](https://patchblox.com/security/data/fix/linux/alsa-2026-28231.md) | Jun 23, 2026 |
| Linux | opencryptoki-ccatok almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-ccatok almalinux 9 | 3.26.0-2.el9_8.2 | [ALSA-2026:28256](https://patchblox.com/security/data/fix/linux/alsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-ccatok ol 10 | 0:3.26.0-3.el10_2.1 | [ELSA-2026-28231](https://patchblox.com/security/data/fix/linux/elsa-2026-28231.md) | Jul 16, 2026 |
| Linux | opencryptoki-ccatok ol 9 | 0:3.26.0-2.el9_8.2 | [ELSA-2026-28256](https://patchblox.com/security/data/fix/linux/elsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-devel RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki-devel RHEL 9 | 0:3.26.0-2.el9_8.2 | [RHSA-2026:28256](https://patchblox.com/security/data/fix/linux/rhsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki-devel almalinux 10 | 3.26.0-3.el10_2.1 | [ALSA-2026:28231](https://patchblox.com/security/data/fix/linux/alsa-2026-28231.md) | Jun 23, 2026 |
| Linux | opencryptoki-devel almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-devel almalinux 9 | 3.26.0-2.el9_8.2 | [ALSA-2026:28256](https://patchblox.com/security/data/fix/linux/alsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-devel ol 10 | 0:3.26.0-3.el10_2.1 | [ELSA-2026-28231](https://patchblox.com/security/data/fix/linux/elsa-2026-28231.md) | Jul 16, 2026 |
| Linux | opencryptoki-devel ol 8 | 0:3.22.0-3.el8_10.3 | [ELSA-2026-26352](https://patchblox.com/security/data/fix/linux/elsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-devel ol 9 | 0:3.26.0-2.el9_8.2 | [ELSA-2026-28256](https://patchblox.com/security/data/fix/linux/elsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-ep11tok RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki-ep11tok RHEL 9 | 0:3.26.0-2.el9_8.2 | [RHSA-2026:28256](https://patchblox.com/security/data/fix/linux/rhsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki-ep11tok almalinux 10 | 3.26.0-3.el10_2.1 | [ALSA-2026:28231](https://patchblox.com/security/data/fix/linux/alsa-2026-28231.md) | Jun 23, 2026 |
| Linux | opencryptoki-ep11tok almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-ep11tok almalinux 9 | 3.26.0-2.el9_8.2 | [ALSA-2026:28256](https://patchblox.com/security/data/fix/linux/alsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-icatok RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki-icatok RHEL 9 | 0:3.26.0-2.el9_8.2 | [RHSA-2026:28256](https://patchblox.com/security/data/fix/linux/rhsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki-icatok almalinux 10 | 3.26.0-3.el10_2.1 | [ALSA-2026:28231](https://patchblox.com/security/data/fix/linux/alsa-2026-28231.md) | Jun 23, 2026 |
| Linux | opencryptoki-icatok almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-icatok almalinux 9 | 3.26.0-2.el9_8.2 | [ALSA-2026:28256](https://patchblox.com/security/data/fix/linux/alsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-icsftok RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki-icsftok RHEL 9 | 0:3.26.0-2.el9_8.2 | [RHSA-2026:28256](https://patchblox.com/security/data/fix/linux/rhsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki-icsftok almalinux 10 | 3.26.0-3.el10_2.1 | [ALSA-2026:28231](https://patchblox.com/security/data/fix/linux/alsa-2026-28231.md) | Jun 23, 2026 |
| Linux | opencryptoki-icsftok almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-icsftok almalinux 9 | 3.26.0-2.el9_8.2 | [ALSA-2026:28256](https://patchblox.com/security/data/fix/linux/alsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-icsftok ol 10 | 0:3.26.0-3.el10_2.1 | [ELSA-2026-28231](https://patchblox.com/security/data/fix/linux/elsa-2026-28231.md) | Jul 16, 2026 |
| Linux | opencryptoki-icsftok ol 8 | 0:3.22.0-3.el8_10.3 | [ELSA-2026-26352](https://patchblox.com/security/data/fix/linux/elsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-icsftok ol 9 | 0:3.26.0-2.el9_8.2 | [ELSA-2026-28256](https://patchblox.com/security/data/fix/linux/elsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-libs RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki-libs RHEL 9 | 0:3.26.0-2.el9_8.2 | [RHSA-2026:28256](https://patchblox.com/security/data/fix/linux/rhsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki-libs almalinux 10 | 3.26.0-3.el10_2.1 | [ALSA-2026:28231](https://patchblox.com/security/data/fix/linux/alsa-2026-28231.md) | Jun 23, 2026 |
| Linux | opencryptoki-libs almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-libs almalinux 9 | 3.26.0-2.el9_8.2 | [ALSA-2026:28256](https://patchblox.com/security/data/fix/linux/alsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-libs ol 10 | 0:3.26.0-3.el10_2.1 | [ELSA-2026-28231](https://patchblox.com/security/data/fix/linux/elsa-2026-28231.md) | Jul 16, 2026 |
| Linux | opencryptoki-libs ol 8 | 0:3.22.0-3.el8_10.3 | [ELSA-2026-26352](https://patchblox.com/security/data/fix/linux/elsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-libs ol 9 | 0:3.26.0-2.el9_8.2 | [ELSA-2026-28256](https://patchblox.com/security/data/fix/linux/elsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-swtok RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki-swtok RHEL 9 | 0:3.26.0-2.el9_8.2 | [RHSA-2026:28256](https://patchblox.com/security/data/fix/linux/rhsa-2026-28256.md) | Jun 24, 2026 |
| Linux | opencryptoki-swtok almalinux 10 | 3.26.0-3.el10_2.1 | [ALSA-2026:28231](https://patchblox.com/security/data/fix/linux/alsa-2026-28231.md) | Jun 23, 2026 |
| Linux | opencryptoki-swtok almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-swtok almalinux 9 | 3.26.0-2.el9_8.2 | [ALSA-2026:28256](https://patchblox.com/security/data/fix/linux/alsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-swtok ol 10 | 0:3.26.0-3.el10_2.1 | [ELSA-2026-28231](https://patchblox.com/security/data/fix/linux/elsa-2026-28231.md) | Jul 16, 2026 |
| Linux | opencryptoki-swtok ol 8 | 0:3.22.0-3.el8_10.3 | [ELSA-2026-26352](https://patchblox.com/security/data/fix/linux/elsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-swtok ol 9 | 0:3.26.0-2.el9_8.2 | [ELSA-2026-28256](https://patchblox.com/security/data/fix/linux/elsa-2026-28256.md) | Jun 23, 2026 |
| Linux | opencryptoki-tpmtok RHEL 8 | 0:3.22.0-3.el8_10.3 | [RHSA-2026:26352](https://patchblox.com/security/data/fix/linux/rhsa-2026-26352.md) | Jun 24, 2026 |
| Linux | opencryptoki-tpmtok almalinux 8 | 3.22.0-3.el8_10.3 | [ALSA-2026:26352](https://patchblox.com/security/data/fix/linux/alsa-2026-26352.md) | Jun 16, 2026 |
| Linux | opencryptoki-tpmtok ol 8 | 0:3.22.0-3.el8_10.3 | [ELSA-2026-26352](https://patchblox.com/security/data/fix/linux/elsa-2026-26352.md) | Jun 16, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.