CVE-2026-111555
Luksmeta: missing slot-range validation permits out-of-gap device i/o
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
6.0
Luksmeta: missing slot-range validation permits out-of-gap device i/o
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
- Record
CVE-2026-111555- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1285
- Updated
- 2026-11-07
EUVDEUVD-2026-102857
6.0
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
- Record
EUVD-2026-102857- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-07
GitHub AdvisoriesGHSA-jjpj-mrvg-445j
6.0
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker...
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
- Record
GHSA-jjpj-mrvg-445j- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1285
- Updated
- 2026-11-02
NVD
6.0
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
- Record
CVE-2026-111555- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1285
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-111555
6.0
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
- Record
DEBIAN-CVE-2026-111555- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-111555
6.0
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
- Record
UBUNTU-CVE-2026-111555- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVAZL-109739 No score
CVE-2026-111555 affecting package luksmeta 9-8
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
- Record
AZL-109739- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
luksmetaAzure Linux:3 |
through 9-8 | None known |
luksmetaDebian:12 |
All versions, plus listed versions 10-110-29-49-4+deb12u1 |
None known |
luksmetaDebian:13 |
All versions, plus listed versions 10-110-29-49-4+deb13u1 |
None known |
luksmetaDebian:14 |
All versions, plus listed versions 10-110-29-4 |
None known |
luksmetaUbuntu:18.04:LTS |
All versions, plus listed versions 8-28-38-3build1 |
None known |
luksmetaUbuntu:20.04:LTS |
All versions, plus listed versions 9-3 |
None known |
luksmetaUbuntu:22.04:LTS |
All versions, plus listed versions 9-3 |
None known |
luksmetaUbuntu:24.04:LTS |
All versions, plus listed versions 9-4 |
None known |
luksmetaUbuntu:26.10 |
All versions, plus listed versions 10-1 |
None known |
luksmetaUbuntu:26.04:LTS |
All versions, plus listed versions 9-410-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | EUVD, OSV | |
| products | CVE List, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-111555 is a medium vulnerability (CVSS 6.0) in Red Hat Enterprise Linux 10, published October 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2026-111555
bugzilla.redhat.com/show_bug.cgi?id=2554026
nvd.nist.gov/vuln/detail/CVE-2026-111555
github.com/advisories/GHSA-jjpj-mrvg-445j
security-tracker.debian.org/tracker/CVE-2026-111555
ubuntu.com/security/CVE-2026-111555
cve.org/CVERecord?id=CVE-2026-111555
github.com/latchset/luksmeta/issues/20
github.com/latchset/luksmeta/pull/21