Vulnerability · Published Feb 25, 2026 · Assigned by redhat
CVE-2026-26104Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api
Medium 5.5
In plain English
A medium-severity missing authorization in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | libudisks2 | 2.10.90-6.el10_1.1.alma.1 | ALSA-2026:3476 |
| AlmaLinux:10 | libudisks2-devel | 2.10.90-6.el10_1.1.alma.1 | ALSA-2026:3476 |
| AlmaLinux:10 | udisks2 | 2.10.90-6.el10_1.1.alma.1 | ALSA-2026:3476 |
| AlmaLinux:10 | udisks2-iscsi | 2.10.90-6.el10_1.1.alma.1 | ALSA-2026:3476 |
| AlmaLinux:10 | udisks2-lsm | 2.10.90-6.el10_1.1.alma.1 | ALSA-2026:3476 |
| AlmaLinux:10 | udisks2-lvm2 | 2.10.90-6.el10_1.1.alma.1 | ALSA-2026:3476 |
| Debian:14 | udisks2 | 2.11.1-1 | DEBIAN-CVE-2026-26104 |
| Rocky Linux:10 | udisks2 | 0:2.10.90-6.el10_1.1 | RLSA-2026:3476 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- RHSA-2026:3476 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:5831 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-26104 vdb-entry, x_refsource_REDHAT
- RHBZ#2433717 issue-tracking, x_refsource_REDHAT
- https://github.com/storaged-project/udisks/security/advisories/GHSA-fcvx-497g-6xmw