CVE-2026-111555

Name	CVE-2026-111555
Description	A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151196

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
luksmeta (PTS)	bookworm	9-4+deb12u1	vulnerable
	trixie	9-4+deb13u1	vulnerable
	forky, sid	10-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
luksmeta	source	(unstable)	(unfixed)			1151196

Notes

[trixie] - luksmeta <no-dsa> (Minor issue)
[bookworm] - luksmeta <postponed> (Minor issue; can be fixed in next update)
https://bugzilla.redhat.com/show_bug.cgi?id=2554026
https://github.com/latchset/luksmeta/issues/20
https://github.com/latchset/luksmeta/pull/21
Fixed by: https://github.com/latchset/luksmeta/commit/62b6491e8318b17ad8472a724ccab8324ec00aae (v11)