Summary
The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.
Security Fix(es):
* udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API (CVE-2026-26104)
* udisks: Missing Authorization Check Allows Unprivileged Users to Restore LUKS Headers via udisks D-Bus API (CVE-2026-26103)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | libudisks2 | 2.10.90-6.el10_1.1.alma.1 |
| AlmaLinux · 10 | libudisks2-devel | 2.10.90-6.el10_1.1.alma.1 |
| AlmaLinux · 10 | udisks2 | 2.10.90-6.el10_1.1.alma.1 |
| AlmaLinux · 10 | udisks2-iscsi | 2.10.90-6.el10_1.1.alma.1 |
| AlmaLinux · 10 | udisks2-lsm | 2.10.90-6.el10_1.1.alma.1 |
| AlmaLinux · 10 | udisks2-lvm2 | 2.10.90-6.el10_1.1.alma.1 |
Vulnerabilities 2
-
High 7.1
Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api
A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to over…
-
Medium 5.5
Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api
A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform…