Source: luksmeta Version: 10-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forarded: https://github.com/latchset/luksmeta/issues/20
Hi, The following vulnerability was published for luksmeta. CVE-2026-111555[0]: | A flaw was found in luksmeta. Improper boundary validation of | metadata slots allows an attacker capable of supplying or modifying | a disk header to redirect wipe or load operations outside the | intended metadata area. An attacker could exploit this vulnerability | by providing a crafted header with valid checksums to overwrite or | zero out encrypted payload data, resulting in persistent data loss | and corrupted storage. Exploitation typically requires privileged | access to modify raw block devices or the ability to induce an | administrator to process an untrusted disk image. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-111555 https://www.cve.org/CVERecord?id=CVE-2026-111555 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2554026 [2] https://github.com/latchset/luksmeta/issues/20 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
