CVE-2026-26103 is a missing authorization vulnerability in the udisks daemon of Red Hat Enterprise Linux 10. The flaw exposes a privileged D-Bus API that allows local unprivileged users to instruct the root-owned udisks daemon to restore LUKS encryption headers without proper permission checks. Exploiting this vulnerability can overwrite encryption metadata on block devices, invalidating encryption keys and causing permanent denial-of-service by making encrypted volumes inaccessible. The vulnerability is rated with a CVSS 3.1 base score of 7.1 (high severity). Red Hat has issued security advisories and updates addressing this issue in udisks2 packages for affected versions.

Successful exploitation allows a local unprivileged user to cause irreversible data loss by overwriting LUKS encryption headers on block devices. This results in denial-of-service by permanently invalidating encryption keys and rendering encrypted volumes inaccessible. There is no confidentiality or integrity impact reported, but the availability impact is high.

Red Hat has released security updates for udisks2 that fix this missing authorization check vulnerability. Users should apply the official patches provided in Red Hat Enterprise Linux 10 versions 10.2 and later, including Extended Update Support releases. Refer to Red Hat advisory RHSA-2026:3476 and RHSA-2026:5831 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps. Applying these updates mitigates the vulnerability. No additional mitigation is required beyond installing the official fixes.