Home

Description

A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.

PUBLISHED Reserved 2026-02-11 | Published 2026-02-25 | Updated 2026-02-25 | Assigner redhat




HIGH: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Problem types

Missing Authorization

Product status

Default status
affected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Timeline

2026-01-28:Reported to Red Hat.
2026-02-25:Made public.

Credits

Red Hat would like to thank Asim Viladi Oglu Manizada for reporting this issue.

References

access.redhat.com/security/cve/CVE-2026-26103 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2433719 (RHBZ#2433719) issue-tracking

cve.org (CVE-2026-26103)

nvd.nist.gov (CVE-2026-26103)

Download JSON