Source: luksmeta Version: 10-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://github.com/latchset/luksmeta/issues/18
Hi Christoph, The following vulnerability was published for luksmeta. CVE-2026-107565[0]: | A flaw was found in luksmeta. A local attacker with administrative | privileges can cause data corruption when saving metadata to a Linux | Unified Key Setup (LUKS) device. Due to incorrect boundary | calculations and flawed overlap detection, new metadata entries can | be written beyond available free space or over existing records. | This issue can corrupt stored encrypted payload data or existing | metadata, potentially rendering the affected data inaccessible. At time there was only the Red Hat bugzilla, I filled a upstream issue to ask more in [2]. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107565 https://www.cve.org/CVERecord?id=CVE-2026-107565 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2547930 [2] https://github.com/latchset/luksmeta/issues/18 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
