CVE catalog
CVE-2025-11568
luksmeta: CVE-2025-11568
- Severity
- Medium · CVSS 4.4
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.10% · Oct 25, 2026
A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | luksmeta | sid | 10-2 | fixed |
| Debian | luksmeta | forky | 10-2 | fixed |
| Debian | luksmeta | trixie | 9-4+deb13u1 | fixed |
| Debian | luksmeta | bookworm | 9-4+deb12u1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | luksmeta | source | sid | 10-1 | not yet assigned | Not reported | [1118280] |
| Debian | luksmeta | source | forky | 10-1 | not yet assigned | Not reported | [1118280] |
| Debian | luksmeta | source | trixie | 9-4+deb13u1 | not yet assigned | Not reported | [1118280] |
| Debian | luksmeta | source | bookworm | 9-4+deb12u1 | not yet assigned | Not reported | [1118280] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libluksmeta0]Fixed
Source package: [luksmeta]
Details (2)
9-4+deb12u1· amd64 · bookwormFixed · Fixed:
9-4+deb12u1dsa · luksmeta · debian · bookworm; dsa · luksmeta · debian · 12
9-4+deb12u1· arm64 · bookwormFixed · Fixed:
9-4+deb12u1dsa · luksmeta · debian · bookworm; dsa · luksmeta · debian · 12
- [libluksmeta-dev]Fixed
Source package: [luksmeta]
Details (2)
9-4+deb12u1· amd64 · bookwormFixed · Fixed:
9-4+deb12u1dsa · luksmeta · debian · bookworm; dsa · luksmeta · debian · 12
9-4+deb12u1· arm64 · bookwormFixed · Fixed:
9-4+deb12u1dsa · luksmeta · debian · bookworm; dsa · luksmeta · debian · 12
- [luksmeta]Fixed
Details (2)
9-4+deb12u1· amd64 · bookwormFixed · Fixed:
9-4+deb12u1dsa · luksmeta · debian · bookworm; dsa · luksmeta · debian · 12
9-4+deb12u1· arm64 · bookwormFixed · Fixed:
9-4+deb12u1dsa · luksmeta · debian · bookworm; dsa · luksmeta · debian · 12
[Debian 13 (Trixie)]
- [libluksmeta0]Fixed
Source package: [luksmeta]
Details (2)
9-4+deb13u1· amd64 · trixieFixed · Fixed:
9-4+deb13u1dsa · luksmeta · debian · 13
9-4+deb13u1· arm64 · trixieFixed · Fixed:
9-4+deb13u1dsa · luksmeta · debian · 13
- [libluksmeta-dev]Fixed
Source package: [luksmeta]
Details (2)
9-4+deb13u1· amd64 · trixieFixed · Fixed:
9-4+deb13u1dsa · luksmeta · debian · 13
9-4+deb13u1· arm64 · trixieFixed · Fixed:
9-4+deb13u1dsa · luksmeta · debian · 13
- [luksmeta]Fixed
Details (2)
9-4+deb13u1· amd64 · trixieFixed · Fixed:
9-4+deb13u1dsa · luksmeta · debian · 13
9-4+deb13u1· arm64 · trixieFixed · Fixed:
9-4+deb13u1dsa · luksmeta · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_23086.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2025-11568]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-11568]
- [https://security-tracker.debian.org/tracker/CVE-2025-11568]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-11568.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2820.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]