CVE-2026-26103: Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api
A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.
Other sources
Missing authorization (polkit) vulnerability in the org.freedesktop.UDisks2.Block.RestoreEncryptedHeader D-Bus method of udisks. The flaw is caused by the absence of a call to udisksdaemonutilcheckauthorizationsync() in the handlerestoreencryptedheader() handler. As a result, any local unprivileged user can invoke this system-bus method and cause the root-privileged udisks daemon to call bdcryptoluksheaderrestore() on an arbitrary block device. This enables destructive overwriting of LUKS headers and keyslots without authentication or user interaction, leading to permanent loss of access to encrypted data and a denial-of-service condition.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26103?
The severity of CVE-2026-26103 is classified as high due to the potential for unprivileged users to restore LUKS encryption headers without authorization.
How do I fix CVE-2026-26103?
To fix CVE-2026-26103, it's recommended to apply the latest security updates provided by your operating system vendor.
Who is affected by CVE-2026-26103?
CVE-2026-26103 affects users of Udisks versions including 2.0.0 and systems running Red Hat Enterprise Linux 10.0.
What are the potential consequences of CVE-2026-26103?
The consequences of CVE-2026-26103 include unauthorized access to sensitive data due to the restoration of LUKS encryption headers.
Is CVE-2026-26103 exploitable remotely?
CVE-2026-26103 is not remotely exploitable as it requires local access to the system to exploit the vulnerability.