CVE-2026-26103

EUVD-2026-8634
A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 0.09%
Affected Products (NVD)
VendorProductVersion
redhatenterprise_linux
10.0
freedesktopudisks
2.0.0
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Enterprise Linux 10
0:2.10.90-6.el10_1.1 ≤
𝑥
< *
ADP
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
0:2.10.90-5.el10_0.2 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
udisks2
bookworm
2.9.4-4+deb12u2
fixed
bookworm (security)
2.9.4-4+deb12u2
fixed
bullseye
2.9.2-2+deb11u1
fixed
bullseye (security)
2.9.2-2+deb11u3
fixed
forky
2.11.2-1
fixed
sid
2.11.2-1
fixed
trixie
2.10.1-12.1+deb13u1
fixed
trixie (security)
2.10.1-12.1+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
udisks2
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
not-affected
trusty
not-affected
xenial
not-affected