luksmeta CVE-2026-111555

Exploitation requires the attacker to control or modify a LUKS disk header processed by luksmeta - concretely, privileged write access to the raw block device, OR the ability to induce an administrator to process an attacker-supplied/untrusted disk image. The crafted header must contain out-of-range metadata slot values accompanied by valid checksums so luksmeta accepts and acts on them during a wipe or load operation. LIMITING FACTORS: this is a local-only vector (AV:L) gated behind high privileges (PR:H) such as root or direct block-device access; it does not apply to default remote or unauthenticated access, and impact is restricted to data integrity/availability (destruction of the encrypted payload) with no information disclosure.

This is a genuine but moderate-risk, high-barrier vulnerability rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N, score 6.0) is internally consistent with the description: exploitation is LOCAL and requires HIGH privileges - specifically the ability to write to raw block devices or to make an administrator process an attacker-supplied disk image. Impact is confined to integrity and availability (I:H/A:H) with NO confidentiality impact (C:N), which matches CWE-1285 (improper validation of a specified index/offset) redirecting wipe/load operations out of bounds. There is no EPSS score, no CISA KEV listing, and no public exploit identified in the provided data, so there is no evidence of active or widespread exploitation - appropriate for a locally-exploitable, privilege-gated data-destruction bug. CONFLICTING SIGNAL: the input Tag 'Information Disclosure' contradicts the CVSS vector, which sets C:N; this flaw causes data loss/corruption, not disclosure, so the tag appears mislabeled and should not drive triage. Net: prioritize patching on systems using luksmeta/Clevis-based LUKS metadata, but this is not a drop-everything internet-facing issue given the PR:H/AV:L constraints.

An attacker who already has privileged (root or raw block-device) access, or who can convince an administrator to attach and process an untrusted disk image, supplies a crafted LUKS header containing out-of-range metadata slot values with valid checksums. When luksmeta validates and processes the header, the improperly bounded slot index redirects a wipe or load operation outside the metadata area, zeroing or overwriting the encrypted payload and causing persistent, unrecoverable data loss. No public exploit code is identified at time of analysis, and the local/high-privilege prerequisites make this a targeted sabotage or malicious-image scenario rather than remote mass exploitation.