CVE-2025-11568

Name	CVE-2025-11568
Description	A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1118280

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
luksmeta (PTS)	bullseye	9-3	vulnerable
	bookworm, trixie	9-4	vulnerable
	forky, sid	10-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
luksmeta	source	(unstable)	10-1			1118280

Notes

[trixie] - luksmeta <no-dsa> (Minor issue)
[bookworm] - luksmeta <no-dsa> (Minor issue)
[bullseye] - luksmeta <postponed> (Minor issue)
https://bugzilla.redhat.com/show_bug.cgi?id=2404244
https://github.com/latchset/luksmeta/pull/16
Fixed by: https://github.com/latchset/luksmeta/commit/017998805ddf98a482bb02fc1d0a09343baab2ca (v10)