Junglewise Threat Intelligence

CVE-2026-26103: udisks missing authorization in LUKS header restoration API

CVE-2026-26103 · Severity: high · CVSS 7.1 · Published 2026-02-25

Technologies: Redhat Enterprise Linux. Vendors: Red Hat, Redhat.

Executive brief

A security flaw in the udisks storage management tool, commonly used in Linux systems to manage hard drives and encrypted volumes, allows unauthorized users to overwrite critical encryption data. By exploiting this, a local user without administrative privileges can permanently lock out legitimate users from their encrypted data. This results in irreversible data loss and a total loss of access to the affected storage volumes.

Technical details

A missing authorization check (CWE-862) exists in the udisks storage management daemon's D-Bus API. Specifically, the API for restoring LUKS (Linux Unified Key Setup) encryption headers does not properly validate the privileges of the requesting user. A local, unprivileged attacker can exploit this by instructing the root-owned udisks daemon to overwrite encryption metadata on block devices with arbitrary or invalid header data. This action permanently invalidates the encryption keys required to decrypt the volume, leading to a permanent denial-of-service through data destruction. Patches have been released for Red Hat Enterprise Linux 10 (udisks2-2.10.90-6.el10_1.1) and RHEL 10.0 EUS (udisks2-2.10.90-5.el10_0.2).

Affected products

  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support udisks2 < 2.10.90-5.el10_0.2
  • Red Hat Red Hat Enterprise Linux 10.1 udisks2 < 2.10.90-6.el10_1.1
  • storaged-project udisks udisks2 versions prior to 2.10.90-5.el10_0.2

Timeline

  • 2026-02-25: advisory: Initial NVD publication date
  • 2026-03-02: patched: Red Hat released RHSA-2026:3476 for RHEL 10.1
  • 2026-03-25: patched: Red Hat released RHSA-2026:5831 for RHEL 10.0 EUS

References

Related threats