CVE-2026-111555— Luksmeta: missing slot-range validation permits out-of-gap device i/o
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 luksmeta 组件中发现一处漏洞：由于对元数据槽的边界验证不当，能够供应或修改磁盘头部的攻击者可利用该缺陷，将擦除（wipe）或加载（load）操作重定向至预期元数据区域之外。攻击者可通过提供带有有效校验和的伪造头部，覆盖或清零加密的有效载荷数据，从而导致数据持久性丢失及存储损坏。利用该漏洞通常需要拥有修改原始块设备的特权，或具备诱导管理员处理不可信磁盘镜像的能力。
Affected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111555
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Luksmeta: missing slot-range validation permits out-of-gap device i/o
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1285
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-111555
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111555
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111555 (2)
-
-
🔗 2554026 – (CVE-2026-111555) CVE-2026-111555 luksmeta: Missing slot-range validation permits out-of-gap device I/O Read full article issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-10-16 · 15 CVEs total
| CVE-2026-104715 | 7.8 HIGH | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary by |
| CVE-2026-105958 | 7.5 HIGH | Spice-server: spice: heap oob read/write via unchecked migration data offsets |
| CVE-2026-105959 | 7.5 HIGH | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncati |
| CVE-2026-62439 | 7.0 HIGH | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow |
| CVE-2026-89085 | 6.6 MEDIUM | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image |
| CVE-2026-111802 | 6.6 MEDIUM | Nautilus: nautilus: arbitrary file deletion via trash symlink |
| CVE-2026-85231 | 6.5 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss de |
| CVE-2026-62438 | 6.1 MEDIUM | Gimp: gimp: paa integer overflow out-of-bounds read |
| CVE-2026-89096 | 5.9 MEDIUM | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd |
| CVE-2026-89088 | 5.5 MEDIUM | Parted: parted: denial of service via heap buffer overflow during fat16 resize |
| CVE-2026-89098 | 5.5 MEDIUM | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd |
| CVE-2026-85977 | 5.3 MEDIUM | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper re |
| CVE-2026-17591 | 3.6 LOW | Libarchive: libarchive: use-after-free via aliased mac metadata copy |
| CVE-2026-111581 | 3.3 LOW | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad
Same vendor: Red Hat
-
CVE-2026-89096
Nfs-utils: nfs-utils: denial of service via memory leak in r -
CVE-2026-89088
Parted: parted: denial of service via heap buffer overflow d -
CVE-2026-89085
Parted: parted: heap-based buffer overflow via crafted fat32 -
CVE-2026-111802
Nautilus: nautilus: arbitrary file deletion via trash symlin -
CVE-2026-17591
Libarchive: libarchive: use-after-free via aliased mac metad
V. Comments for CVE-2026-111555
No comments yet