CVE-2025-11568

A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue.

• CWE-1284

• https://access.redhat.com/errata/RHSA-2025:23086
• https://access.redhat.com/errata/RHSA-2026:18421
• https://access.redhat.com/errata/RHSA-2026:18824
• https://access.redhat.com/security/cve/CVE-2025-11568
• https://bugzilla.redhat.com/show_bug.cgi?id=2404244
• https://github.com/latchset/luksmeta/pull/16

Published

Oct 15, 2025

Last Modified

Jun 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11561A flaw was found in the integration of Active Directory and …8.8
• CVE-2025-11563URLs containing percent-encoded slashes (`/` or `\`) can tri…4.6
• CVE-2025-11564The Tutor LMS – eLearning and online course solution plugin …5.3
• CVE-2025-11565CWE-22: Improper Limitation of a Pathname to a Restricted Di…7.3
• CVE-2025-11566CWE-307: Improper Restriction of Excessive Authentication At…6.9
• CVE-2025-11567CWE-276: Incorrect Default Permissions vulnerability exists …7.3
• CVE-2025-11569Rejected reason: This record was withdrawn by its CNA; furth…
• CVE-2025-1157A vulnerability was found in Allims lab.online up to 2025020…6.3
• CVE-2025-11570Versions of the package drupal-pattern-lab/unified-twig-exte…4.6
• CVE-2025-11571Vulnerable endpoints accept user-controlled input through a …2.1
• CVE-2025-11573An infinite loop issue in Amazon.IonDotnet library versions …8.7
• CVE-2025-11575Incorrect Default Permissions vulnerability in MongoDB Atlas…8.8