CVE-2026-111555

Overview

luksmeta boundary validation flaw allows privileged attackers to redirect wipe or load operations outside intended metadata area, potentially overwriting encrypted payload data. The vulnerability can cause persistent data loss on affected storage devices. It requires raw block device access or an untrusted disk image to be processed.

Description

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.

Impact

The flaw compromises confidentiality by enabling data overwrite, integrity by corrupting encrypted payloads, and availability through persistent data loss. Defenders are impacted if they rely on LUKS-based encryption for sensitive data. Attackers with privileged access to raw devices can exploit this.

Remediation

Apply the latest patch for luksmeta or upgrade to a version that fixes the boundary validation. Restrict raw block device access to trusted users only. Verify disk headers with checksum validation before processing and avoid using untrusted disk images.

Risk context

Severity is high with CVSS v3 score 7.5. No EPSS data available. The risk is moderate to high for environments using luksmeta for disk encryption, especially where raw device access is granted.

Affected products

• luksmeta