CVE-2026-111555
MediumCVSS 6.0Summary
A flaw was found in luksmeta involving improper boundary validation of metadata slots. An attacker able to supply or modify a disk header can redirect wipe or load operations outside the intended metadata area, overwriting or zeroing out encrypted payload data and causing persistent data loss.
Risk Assessment
Exploitation requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image, potentially resulting in persistent data loss and corrupted storage.
Recommendation
Update luksmeta to a patched version, avoid processing untrusted disk images, and restrict access to raw block devices.
Other vulnerabilities in luksmeta
See all- CVE-2026-107565Medium
A flaw was found in luksmeta involving incorrect boundary calculations and flawed overlap detection. A local attacker with administrative privileges can write new metadata entries beyond available free space or over existing records, corrupting data on a LUKS device.
- CVE-2025-11568Medium
A data corruption vulnerability in the luksmeta utility for LUKS1 allows overwriting encrypted data by writing excessive metadata. Lack of space validation leads to permanent loss of user data.
Original NVD description (English source)
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS