{"id":"CVE-2026-111555","kind":"vulnerability","aliases":["CVE-2026-111555"],"related":[],"title":"luksmeta: crafted LUKS header can wipe or overwrite encrypted payload data","description":"A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.","summary":"luksmeta, the library that stores LUKS2 keyslot metadata, does not validate metadata slot boundaries. A crafted disk header with valid checksums can redirect wipe or load operations outside the metadata area, zeroing or overwriting encrypted data.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disk-encryption","infrastructure","linux","luksmeta"],"not_affected_if":["no-raw-block-device-write-access","no-untrusted-disk-images"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T13:16:56+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:05:53+00:00","updated_at":"2026-10-25T04:05:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:05:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"luksmeta: crafted LUKS header can wipe or overwrite encrypted payload data","impact":"high","summary":"luksmeta, the library that stores LUKS2 keyslot metadata, does not validate metadata slot boundaries. A crafted disk header with valid checksums can redirect wipe or load operations outside the metadata area, zeroing or overwriting encrypted data.","category":"infrastructure","nicknames":[],"who_cares":["luksmeta","linux","disk-encryption"],"confidence":0.6,"needs_auth":"yes","worst_case":"encrypted payload data is overwritten or zeroed, causing persistent data loss","analyst_note":"Find the affected versions and the upstream fix commit from the NVD entry and the luksmeta project repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-disk-images","no-raw-block-device-write-access"],"who_is_affected":"Systems that process untrusted or externally supplied LUKS disk images or headers with luksmeta, or where someone with write access to a raw block device could alter a header. The sources do not name specific versions or distributions, and they do not say whether ordinary use of locally created encrypted volumes is exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000577,"input_tokens":3366,"output_tokens":480,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111555':14A,17A '-2026':13A,16A 'abil':136C 'access':128C 'administr':140C 'allow':72C 'area':54B,93C 'attack':74C,95C 'block':132C 'boundari':37B,67C 'capabl':75C 'checksum':44B,107C 'corrupt':122C 'could':96C 'craft':2A,39B,103C 'cve':12A,15A 'data':11A,59B,115C,119C 'devic':133C 'disk':19B,40B,81C,145C 'disk-encrypt':18B 'encrypt':9A,20B,58B,113C 'exploit':97C,124C 'flaw':61C 'found':63C 'header':4A,41B,82C,104C 'imag':146C 'improp':66C 'induc':138C 'infrastructur':21B 'intend':91C 'keyslot':30B 'librari':26B 'linux':22B 'load':49B,87C 'loss':120C 'luk':3A 'luks2':29B 'luksmeta':1A,23B,24B,65C 'metadata':31B,35B,53B,70C,92C 'modifi':79C,130C 'oper':50B,88C 'outsid':51B,89C 'overwrit':8A,57B,109C 'payload':10A,114C 'persist':118C 'privileg':127C 'process':142C 'provid':101C 'raw':131C 'redirect':46B,84C 'requir':126C 'result':116C 'slot':36B,71C 'storag':123C 'store':28B 'suppli':77C 'typic':125C 'untrust':144C 'valid':34B,43B,68C,106C 'vulner':99C 'wipe':6A,47B,85C 'zero':55B,111C","nicknames":[],"mitigations":[],"who_affected":"Systems that process untrusted or externally supplied LUKS disk images or headers with luksmeta, or where someone with write access to a raw block device could alter a header. The sources do not name specific versions or distributions, and they do not say whether ordinary use of locally created encrypted volumes is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111555","severity":null,"published_at":"2026-10-16T13:16:56+00:00","modified_at":"2026-10-19T15:16:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}