luksmeta EUVD-2026-95032

Exploitation requires local access to the host AND existing administrative privileges sufficient to run luksmeta and write metadata to a LUKS device (AV:L/PR:H); there is no remote vector and no unauthenticated path. The flaw triggers specifically when saving a new metadata entry to a LUKS device whose free space or existing slot layout causes the faulty boundary/overlap detection to misfire - i.e., it is tied to the luksmeta metadata-write operation on an initialized LUKS volume rather than to any network service or default-config exposure. The dominant limiting factor is the PR:H prerequisite: an actor with this access level can already damage the system by other means, so the realistic impact is accidental or deliberate data corruption by a privileged operator, not privilege escalation or cross-user compromise.

This is a genuinely low-priority issue despite affecting enterprise Linux platforms. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L, base 5.1 MEDIUM) is the dominant signal and it points to a local, high-privilege prerequisite: an attacker must already hold administrative privileges (PR:H) with local access (AV:L) to the host. There is no confidentiality impact (C:N); the harm is integrity/availability - corruption of LUKS metadata or encrypted payload. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data. Because successful exploitation requires an actor who is already root/admin on the system, the practical attack surface is narrow - an admin can already damage a disk by many other means, so this reads as a reliability/data-integrity defect more than a privilege-boundary breach. Note a conflict with the input tagging: the 'Information Disclosure' tag contradicts the CVSS vector (C:N) and the description, which describe data corruption, not disclosure - verify tag before using for triage. No active-exploitation or POC evidence is present, so this should be patched on a routine cycle rather than treated as urgent.

An attacker who has already gained administrative (root) privileges on a RHEL or OpenShift host runs luksmeta to save metadata to a LUKS device; due to incorrect boundary calculations and flawed overlap detection, the tool writes a new metadata slot beyond free space or over an existing record, corrupting stored metadata or encrypted payload and potentially rendering the LUKS volume inaccessible. This requires local access and existing high privileges (AV:L/PR:H), and no public exploit was identified at time of analysis.