Hi,

The following vulnerability was published for luksmeta.

CVE-2026-111555[0]:
| A flaw was found in luksmeta. Improper boundary validation of
| metadata slots allows an attacker capable of supplying or modifying
| a disk header to redirect wipe or load operations outside the
| intended metadata area. An attacker could exploit this vulnerability
| by providing a crafted header with valid checksums to overwrite or
| zero out encrypted payload data, resulting in persistent data loss
| and corrupted storage. Exploitation typically requires privileged
| access to modify raw block devices or the ability to induce an
| administrator to process an untrusted disk image.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111555
https://www.cve.org/CVERecord?id=CVE-2026-111555
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2554026
[2] https://github.com/latchset/luksmeta/issues/20

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
luksmeta, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151196@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Christoph Biedl <debian.axhn@manchmal.in-ulm.de> (supplier of updated luksmeta package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 18 Oct 2026 20:35:07 +0200
Source: luksmeta
Architecture: source
Version: 10-2
Distribution: unstable
Urgency: high
Maintainer: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
Changed-By: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
Closes: 1151196
Changes:
 luksmeta (10-2) unstable; urgency=high
 .
   * Cherry-pick "fix gap allocator bounds checking".
     Closes: #1151196 [CVE-2026-111555]
Checksums-Sha1:
 55e7b7de6865a7f01e60a8cabc1462fdd1366368 2021 luksmeta_10-2.dsc
 3b65a09b17e9f8d66fed5bac6243d2cc91d3c8fa 7348 luksmeta_10-2.debian.tar.xz
 ffdf399f7a557f8aad489b87cca1387149da80c4 7635 luksmeta_10-2_powerpc.buildinfo
Checksums-Sha256:
 6ca08d1f55d5d4c8fdf2736f5084b7afcc2ac8905a0f1b09c6ab7151e57a50fc 2021 luksmeta_10-2.dsc
 975619f54410975dfc44acbd692a8b1a9e1c19b6cd3c6ba888455605b1eb0494 7348 luksmeta_10-2.debian.tar.xz
 9c8fb4ef385cd893f481c4accecc83a13f0d4301f2c6b5b8bf9995702e5f611c 7635 luksmeta_10-2_powerpc.buildinfo
Files:
 c411d94e04fba2dcd74812db60685d8c 2021 net optional luksmeta_10-2.dsc
 252f63ab33f261a6f5fa6697ef3308c6 7348 net optional luksmeta_10-2.debian.tar.xz
 366219c68b3ed0ac4f0b9794853222d6 7635 net optional luksmeta_10-2_powerpc.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEWXMI+726A12MfJXdxCxY61kUkv0FAmrVKqIACgkQxCxY61kU
kv2DmxAAxl7B7YCSzyMQDOVaz5yvTRiX2d7n9WVIaVXY5q2g8sxxRFPn1SlJlKsq
T3nWERRJe5snz4zREtoGG9isIcTV+6peYJBRy7Bqwv7vB71PBra9T/djA03dk2Vv
0RSaYry6zIl93RNdvECyaf5koDdy304K1uhdVKD3903vcYghHJ4a1DLlcg50FJMH
wLqGHxFBC/sb+4UH9zplWpym3QWdsulAAb2BkEssI1j677QVmPS9bE6uB6X10yP3
H8fGBrkrIhh3lqQnTxRFep35vUtKZNiLL9D5ag+6hPSU7dOMuB8SpkzfiX6s7hvk
Y3QuYNJTgO5GlOFsMLhMAqw7hddXpDapHiD/gLE4SUwSqupvmQWGTVETJepQDt4Z
7IwILzrKQOTtZf3CZ1AkPkUpNVG2utSLK/k4PW0yVG037DlMe0Fe6Q9HkTSbWK//
68gqg4nLlZ/PS+PIYWtvRUIhHCSdpMnQQ6IGgmxejItjWQXIrU7XnSQ6pUFtAHii
Qxde7NuAcpcS+u71osPGCxpHoV7h8Su9+EV+2Oxq8jdXnaZu8XGSSBYODFZVJ1Va
IFpVrxy888u4gTQukYUuZnCD53DIY+x0/DUIyJk5Hdil+pgC1EZsOJSOq9kNYpGI
IkIhHCJQWMw8B3ftF0OtL0rZ1m1G9kkpgPBL2lEqUs0d+hD1pDU=
=XjWV
-----END PGP SIGNATURE-----