CVE-2026-26103
High · 7.1CVSS
7.1
EPSS
0.1%
Published
Feb 25, 2026
CISA due date
—
The record
A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | udisks2 | 0 | 2.11.0-2.1 |
Related vulnerabilities
- CVE-2026-26104 A flaw was found in the udisks storage management daemon that allows unprivileged users… Also affects udisks2
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862
- CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. CWE-862
- CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful… CWE-862
- CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful… CWE-862
- CVE-2026-87943 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful… CWE-862
- CVE-2026-84916 Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. CWE-862