CVE-2026-107565
Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
- Record
CVE-2026-107565- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-05
EUVDEUVD-2026-95032
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
- Record
EUVD-2026-95032- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-vwc5-xqph-7vp5
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data...
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
- Record
GHSA-vwc5-xqph-7vp5- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-02
NVD
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
- Record
CVE-2026-107565- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-1284
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-107565
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
- Record
DEBIAN-CVE-2026-107565- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-107565
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
- Record
UBUNTU-CVE-2026-107565- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
luksmetaDebian:12 |
All versions, plus listed versions 10-110-29-49-4+deb12u1 |
None known |
luksmetaDebian:13 |
All versions, plus listed versions 10-110-29-49-4+deb13u1 |
None known |
luksmetaDebian:14 |
before 10-2, plus listed versions 10-19-4 |
10-2 |
luksmetaUbuntu:18.04:LTS |
All versions, plus listed versions 8-28-38-3build1 |
None known |
luksmetaUbuntu:20.04:LTS |
All versions, plus listed versions 9-3 |
None known |
luksmetaUbuntu:22.04:LTS |
All versions, plus listed versions 9-3 |
None known |
luksmetaUbuntu:24.04:LTS |
All versions, plus listed versions 9-4 |
None known |
luksmetaUbuntu:26.10 |
All versions, plus listed versions 10-1 |
None known |
luksmetaUbuntu:26.04:LTS |
All versions, plus listed versions 9-410-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | CVE List, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107565 is a medium vulnerability (CVSS 5.1) in Red Hat Enterprise Linux 10, published October 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. Fixed in luksmeta 10-2.