Description
A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Latchset | luksmeta | < 10 | 10 |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | luksmeta | 10-1 | — |
| Debian 13 | luksmeta | 9-4+deb13u1 | — |
| Debian 12 | luksmeta | 9-4+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | luksmeta | No fix yet | — |
| Ubuntu 26.04 LTS | luksmeta | No fix yet | — |
| Ubuntu 25.10 | luksmeta | No fix yet | — |
| Ubuntu 24.04 LTS | luksmeta | No fix yet | — |
| Ubuntu 22.04 LTS | luksmeta | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | luksmeta | No fix yet | — |
| Ubuntu 18.04 LTS | luksmeta | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | luksmeta +2 | 10-1.el10 | RHSA-2026:18421 |
| RHEL 9 | luksmeta +2 | 10-1.el9 | RHSA-2026:18824 |
| RHEL 8 | luksmeta +2 | 9-4.el8_10.1 | RHSA-2025:23086 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | luksmeta +2 | 10-1.el10 | ALSA-2026:18421 |
| AlmaLinux 9 | luksmeta +2 | 10-1.el9 | ALSA-2026:18824 |
| AlmaLinux 8 | luksmeta +2 | 9-4.el8_10.1 | ALSA-2025:23086 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | luksmeta | 10-1.el10 | RLSA-2026:18421 |
| Rocky Linux 9 | luksmeta | 10-1.el9 | RLSA-2026:18824 |
| Rocky Linux 8 | luksmeta | 9-4.el8_10.1 | RLSA-2025:23086 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | luksmeta | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | luksmeta +2 | 10-1.el10 | ELSA-2026-18421 |
| Oracle Linux 9 | luksmeta +2 | 10-1.el9 | ELSA-2026-18824 |
| Oracle Linux 8 | luksmeta +2 | 9-4.el8_10.1 | ELSA-2025-23086 |
Advisories 13
- ALSA-2026:18824 Moderate: luksmeta security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:18421 Moderate: luksmeta security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:23086 Moderate: luksmeta security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:18824 Red Hat Security Advisory: luksmeta security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- RHSA-2026:18421 Red Hat Security Advisory: luksmeta security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- RHSA-2025:23086 Red Hat Security Advisory: luksmeta security update Red Hat Security Advisories (RHSA) · Sep 2, 2026
- ELSA-2026-18421 Moderate: luksmeta security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- WID-SEC-2025-2820 Red Hat Enterprise Linux (luksmeta): Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Jun 22, 2026
- ELSA-2026-18824 Moderate: luksmeta security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 12, 2026
- RLSA-2026:18421 Moderate: luksmeta security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:18824 Moderate: luksmeta security update Rocky Linux Security Advisories · May 28, 2026
- RLSA-2025:23086 Moderate: luksmeta security update Rocky Linux Security Advisories · Dec 13, 2025
- ELSA-2025-23086 Moderate: luksmeta security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 10, 2025
References
- RHSA-2025:23086 vendor-advisory
- RHSA-2026:18421 vendor-advisory
- RHSA-2026:18824 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-11568 vdb-entry
- RHBZ#2404244 issue-tracking
- https://github.com/latchset/luksmeta/pull/16