Vulnerability · Published Oct 16, 2026 · Assigned by redhat
CVE-2026-111555Luksmeta: missing slot-range validation permits out-of-gap device i/o
Medium 6.0
In plain English
A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | luksmeta | no fix listed | DEBIAN-CVE-2026-111555 |
| Debian:13 | luksmeta | no fix listed | DEBIAN-CVE-2026-111555 |
| Debian:14 | luksmeta | no fix listed | DEBIAN-CVE-2026-111555 |
| Ubuntu:22.04:LTS | luksmeta | no fix listed | UBUNTU-CVE-2026-111555 |
| Ubuntu:24.04:LTS | luksmeta | no fix listed | UBUNTU-CVE-2026-111555 |
| Ubuntu:26.04:LTS | luksmeta | no fix listed | UBUNTU-CVE-2026-111555 |
| Ubuntu:26.10 | luksmeta | no fix listed | UBUNTU-CVE-2026-111555 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 5 | see references |
Weakness: CWE-1285 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-111555 vdb-entry, x_refsource_REDHAT
- RHBZ#2554026 issue-tracking, x_refsource_REDHAT