CVE-2026-26103: Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api
A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26103?
The severity of CVE-2026-26103 is classified as high due to the potential for unprivileged users to restore LUKS encryption headers without authorization.
How do I fix CVE-2026-26103?
To fix CVE-2026-26103, it's recommended to apply the latest security updates provided by your operating system vendor.
Who is affected by CVE-2026-26103?
CVE-2026-26103 affects users of Udisks versions including 2.0.0 and systems running Red Hat Enterprise Linux 10.0.
What are the potential consequences of CVE-2026-26103?
The consequences of CVE-2026-26103 include unauthorized access to sensitive data due to the restoration of LUKS encryption headers.
Is CVE-2026-26103 exploitable remotely?
CVE-2026-26103 is not remotely exploitable as it requires local access to the system to exploit the vulnerability.