OpenSSL: attacker-controlled CMP sender DN reaches ERR_raise_data() as a format string, crashing the client

Impact

A CMP client that enforces an expected sender or pins a server certificate passes the peer-supplied sender distinguished name straight into ERR_raise_data() as the format string, so a DN like "CN=%s%n" is interpreted by BIO_vsnprintf() with no matching arguments and the process crashes. OpenSSL states the reliable consequence is denial of service only - no controlled write, no arbitrary-address read, no credible path to code execution. On a GPU fleet this matters where CMP is used for automated certificate enrollment and renewal of node, fabric-management or internal PKI certificates: a malicious or intercepted CMP endpoint can kill the enrolling process, and certificates that fail to renew eventually take services offline. It is not a tenant-reachable bug and does not touch the FIPS module, since CMP sits outside the module boundary.

Who can reach it

Whoever operates or can intercept the CMP server endpoint the client talks to - a hostile CA front end or an on-path attacker on the enrollment path. No authentication to the client is needed; the client just has to be configured with an expected sender or a pinned server certificate, which is the normal validating configuration. Systems that never speak CMP are unaffected.

What to do

Update OpenSSL to the fixed release named in the 2026-08-25 OpenSSL advisory (the record does not carry version numbers - read the advisory before scheduling), then restart every daemon linked against the library; statically linked binaries need rebuilding. No node drain or reboot is required. If patching has to wait, the exposure is limited to hosts running CMP enrollment against endpoints you do not fully control, so restricting or pausing CMP traffic to trusted CAs is a workable stopgap.

References

Related entries

• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A NULL pointer dereference in the amdkfd (KFD computeCVE-2026-63882 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Unscored
• Linux kernel x86: no IBPB flush on BPF JIT memory reuse while Spectre-v2 mitigations are in useCVE-2026-64507 · Linux kernel x86/bugs (IBPB flush on BPF JIT allocation)Unscored
• Linux kernel BPF JIT: reused JIT memory can inherit branch predictions from the program that freed itCVE-2026-64508 · Linux kernel BPF JIT allocator (branch-predictor flush on JIT memory reuse)Unscored
• Linux i915 GPU kernel driver (context SSEU parameter): NULL dereference reachable by setting a context engine slotCVE-2026-68243 · Linux i915 GPU kernel driver (context SSEU parameter)Unscored
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A correctness defect in the amdkfd (KFD computeCVE-2026-68259 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Unscored
• Linux kernel Intel IOMMU: out-of-bounds memset in dmar_latency_disable() corrupts adjacent memoryCVE-2026-68324 · Linux kernel Intel IOMMU (dmar_latency_disable)Unscored