CVE-2026-111555: Improper Validation of Specified Index, Position, or Offset in Input in Red Hat Red Hat Enterprise Linux 10

This vulnerability in luksmeta arises from improper validation of specified index, position, or offset in input metadata slots. An attacker capable of providing a crafted disk header with valid checksums can redirect wipe or load operations beyond the intended metadata area. This can overwrite or zero out encrypted payload data, resulting in persistent data loss and storage corruption. Exploitation typically requires high privileges to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.

The vulnerability allows an attacker with privileged access or the ability to supply a crafted disk header to cause persistent data loss and corruption of encrypted storage by overwriting or zeroing encrypted payload data. There is no confidentiality impact, but integrity and availability are severely affected.

The vendor advisory from Red Hat should be consulted for current remediation guidance. No explicit patch or fix information is provided in the input data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-111555 for updates. Until a fix is applied, restrict privileged access to raw block devices and avoid processing untrusted disk images.