CVE-2026-26103
📋 TL;DR
A local privilege escalation vulnerability in udisks allows unprivileged users to trigger the root-owned daemon to overwrite LUKS encryption headers. This permanently destroys encryption keys, rendering encrypted volumes inaccessible and causing irreversible data loss. All systems running vulnerable udisks versions with LUKS-encrypted volumes are affected.
💻 Affected Systems
- udisks
- udisks2
📦 What is this software?
Udisks by Freedesktop
⚠️ Risk & Real-World Impact
Worst Case
Complete and permanent loss of all data on LUKS-encrypted volumes, requiring full restoration from backups.
Likely Case
Targeted destruction of specific encrypted volumes by malicious local users, causing denial of service through data loss.
If Mitigated
No impact if proper access controls prevent local unprivileged users from interacting with udisks D-Bus interface.
🎯 Exploit Status
Exploitation requires local user access but is straightforward via D-Bus calls. No authentication bypass needed beyond local user privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: udisks2-2.10.0 or later
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2026-26103
Restart Required: Yes
Instructions:
1. Update udisks package using your distribution's package manager. 2. Restart the udisks service or reboot the system. 3. Verify the updated version is running.
🔧 Temporary Workarounds
Restrict D-Bus access to udisks
linuxConfigure D-Bus policy to restrict which users can call the vulnerable udisks methods
Create /etc/dbus-1/system.d/udisks2.conf with restrictive policies
Disable udisks service
linuxStop and disable the udisks daemon if not required
systemctl stop udisks2
systemctl disable udisks2
🧯 If You Can't Patch
- Implement strict access controls to prevent local unprivileged users from accessing the system
- Monitor D-Bus traffic for suspicious calls to udisks methods related to LUKS header operations
🔍 How to Verify
Check if Vulnerable:
Check udisks version: udisksctl --version or rpm -q udisks2Check Version:
udisksctl --version || rpm -q udisks2 || dpkg -l | grep udisks2Verify Fix Applied:
Verify version is 2.10.0 or higher and test that unprivileged users cannot call the vulnerable D-Bus methods📡 Detection & Monitoring
Log Indicators:
- D-Bus audit logs showing unauthorized calls to org.freedesktop.UDisks2 methods
- System logs showing unexpected LUKS header operations
Network Indicators:
- Not applicable - local attack only
SIEM Query:
source="d-bus" AND method_call="*UDisks2*" AND (user!="root" OR user!="system")