Vulnerability in Latchset Luksmeta
CVE-2025-11568
A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue.
EPSS: 0.001 (0.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Latchset Luksmeta — versions 0
- Red Hat Enterprise Linux 10 — versions 0:10-1.el10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8 — versions 0:9-4.el8_10.1
- Red Hat Enterprise Linux 9 — versions 0:10-1.el9
- Red Hat In-vehicle Operating System 1
- Red Hat Openshift Container Platform 4
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
- secalert@redhat.com
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
Frequently asked questions
- What is CVE-2025-11568?
- CVE-2025-11568 is a medium-severity vulnerability in Latchset Luksmeta, classified under Improper Validation of Specified Quantity in Input. CVSS score: 4.4/10. Published 2025-10-15.
- How severe is CVE-2025-11568?
- Medium severity. CVSS v3 base score is 4.4 out of 10.