A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key… (CVE-2026-107565)

CVE-2026-107565 describes a flaw in luksmeta where a local attacker with administrative privileges can cause data corruption during metadata saving operations on LUKS devices. The vulnerability arises from incorrect boundary calculations and flawed overlap detection, which may result in new metadata entries overwriting existing records or exceeding available free space. This can corrupt the encrypted payload or metadata, potentially rendering the data inaccessible. The CVSS 3.1 base score is 5.1, reflecting a low severity with impact primarily on integrity and availability, requiring local privileged access and no user interaction.

The flaw can lead to corruption of encrypted payload data or existing metadata on LUKS devices, potentially making the affected data inaccessible. There is no confidentiality impact reported. The attacker must have local administrative privileges to exploit this issue. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only to mitigate risk.