Is CVE-2026-26103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26103 being exploited in the wild.

How severe is CVE-2026-26103?

High severity, with a CVSS score of 7.1, published 25 February 2026.

Which products and versions are affected?

Red Hat Enterprise Linux 10.0 Extended Update Support udisks2 < 2.10.90-5.el10_0.2; Red Hat Enterprise Linux 10.1 udisks2 < 2.10.90-6.el10_1.1.

Is there a fix for CVE-2026-26103?

A patch was published on 2026-03-02: Red Hat released RHSA-2026:3476 for RHEL 10.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26103 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-26103?

Check whether you run Freedesktop Udisks, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 10.1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26103: udisks missing authorization in LUKS header restoration API

Q: Is there a fix for CVE-2026-26103?

A patch was published on 2026-03-02: Red Hat released RHSA-2026:3476 for RHEL 10.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-26103 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2026-26103?

Check whether you run Freedesktop Udisks, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 10.1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26103 · Severity: high · CVSS 7.1 · Published 2026-02-25

A security flaw in the udisks storage management tool, commonly used in Linux systems to manage hard drives and encrypted volumes, allows unauthorized users to overwrite critical encryption data. By exploiting this, a local user without administrative privileges can permanently lock out legitimate users from their encrypted data. This results in irreversible data loss and a total loss of access to the affected storage volumes.

Technologies: Redhat Enterprise Linux. Vendors: Freedesktop, Red Hat, Redhat.

Quick answers

Is CVE-2026-26103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26103 being exploited in the wild.
How severe is CVE-2026-26103?: High severity, with a CVSS score of 7.1, published 25 February 2026.
Which products and versions are affected?: Red Hat Enterprise Linux 10.0 Extended Update Support udisks2 < 2.10.90-5.el10_0.2; Red Hat Enterprise Linux 10.1 udisks2 < 2.10.90-6.el10_1.1.
Is there a fix for CVE-2026-26103?: A patch was published on 2026-03-02: Red Hat released RHSA-2026:3476 for RHEL 10.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26103 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-26103?: Check whether you run Freedesktop Udisks, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 10.1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) exists in the udisks storage management daemon's D-Bus API. Specifically, the API for restoring LUKS (Linux Unified Key Setup) encryption headers does not properly validate the privileges of the requesting user. A local, unprivileged attacker can exploit this by instructing the root-owned udisks daemon to overwrite encryption metadata on block devices with arbitrary or invalid header data. This action permanently invalidates the encryption keys required to decrypt the volume, leading to a permanent denial-of-service through data destruction. Patches have been released for Red Hat Enterprise Linux 10 (udisks2-2.10.90-6.el10_1.1) and RHEL 10.0 EUS (udisks2-2.10.90-5.el10_0.2).

Affected products

Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support udisks2 < 2.10.90-5.el10_0.2
Red Hat Red Hat Enterprise Linux 10.1 udisks2 < 2.10.90-6.el10_1.1
storaged-project udisks udisks2 versions prior to 2.10.90-5.el10_0.2

Timeline

2026-02-25: advisory: Initial NVD publication date
2026-03-02: patched: Red Hat released RHSA-2026:3476 for RHEL 10.1
2026-03-25: patched: Red Hat released RHSA-2026:5831 for RHEL 10.0 EUS

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.