Bug 2554026 (CVE-2026-111555)

Summary: CVE-2026-111555 luksmeta: Missing slot-range validation permits out-of-gap device I/O
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2554027    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-16 11:21:25 UTC 
A flaw was found in luksmeta. The read_header() function validates occupied slot offsets and lengths separately without ensuring that each complete range remains within the LUKS1 metadata gap. A crafted header with a valid CRC32C checksum can therefore direct subsequent luksmeta_load() or luksmeta_wipe() operations outside the intended metadata area on the same opened device or image. The wipe operation can zero encrypted payload data, potentially causing persistent data loss or making filesystem contents inaccessible. A wrapping slot endpoint can also misposition the subsequent metadata-header rewrite. Exploitation on a deployed block device normally requires root or equivalent raw write access, which already permits direct storage corruption and substantially limits the additional capability gained. The command-line load path suppresses output when the data CRC check fails; no incremental confidentiality impact or privilege escalation has been established. Source review confirms that this parser defect remains after the allocator fix for CVE-2026-107565. The reviewed code path explicitly rejects LUKS2 devices.