Udisks2: Missing Authorization in Red Hat Red Hat Enterprise Linux 10 (CVE-2026-26103)
A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.
AI Analysis
Technical Summary
The Udisks project provides a daemon, tools, and libraries to manage disks and storage devices. Two vulnerabilities (CVE-2026-26103 and CVE-2026-26104) exist in udisks2 due to missing authorization checks in the D-Bus API, allowing unprivileged users to back up and restore LUKS disk encryption headers. These flaws could potentially allow unauthorized manipulation of encrypted disk headers. Red Hat has released updated udisks2 packages for Red Hat Enterprise Linux 10 and related products to fix these issues. The advisory RHSA-2026:3476 provides details and instructions for applying the update. No known exploits in the wild have been reported.
Potential Impact
Unprivileged users could exploit these vulnerabilities to back up or restore LUKS encryption headers without proper authorization. This could lead to unauthorized access or manipulation of encrypted disk volumes, potentially compromising data confidentiality or integrity on affected systems. The impact is significant given the role of LUKS headers in disk encryption management.
Mitigation Recommendations
Red Hat has released security updates for udisks2 addressing these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related products should apply the updated packages as described in Red Hat advisory RHSA-2026:3476 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No alternative mitigations or workarounds are indicated in the advisory.
Udisks2: Missing Authorization in Red Hat Red Hat Enterprise Linux 10 (CVE-2026-26103)
Description
A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Udisks project provides a daemon, tools, and libraries to manage disks and storage devices. Two vulnerabilities (CVE-2026-26103 and CVE-2026-26104) exist in udisks2 due to missing authorization checks in the D-Bus API, allowing unprivileged users to back up and restore LUKS disk encryption headers. These flaws could potentially allow unauthorized manipulation of encrypted disk headers. Red Hat has released updated udisks2 packages for Red Hat Enterprise Linux 10 and related products to fix these issues. The advisory RHSA-2026:3476 provides details and instructions for applying the update. No known exploits in the wild have been reported.
Potential Impact
Unprivileged users could exploit these vulnerabilities to back up or restore LUKS encryption headers without proper authorization. This could lead to unauthorized access or manipulation of encrypted disk volumes, potentially compromising data confidentiality or integrity on affected systems. The impact is significant given the role of LUKS headers in disk encryption management.
Mitigation Recommendations
Red Hat has released security updates for udisks2 addressing these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related products should apply the updated packages as described in Red Hat advisory RHSA-2026:3476 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No alternative mitigations or workarounds are indicated in the advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:3476
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-26104"]
- Cvss Version
- null
Threat ID: 6a3da1c34853345fc181f015
Added to database: 06/25/2026, 21:46:43 UTC
Last enriched: 07/12/2026, 10:03:26 UTC
Last updated: 07/31/2026, 19:24:49 UTC
Views: 23
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.