CVE-2025-11568: 
Linux Debian vulnerability analysis and mitigation

A data corruption vulnerability (CVE-2025-11568) has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. The vulnerability was disclosed on October 15, 2025. The issue specifically affects systems using LUKS1 format for disk encryption, while other LUKS versions are not impacted (NVD).

The vulnerability stems from improper validation of available space between the LUKS1 header and the encrypted data payload. When writing large amounts of metadata, the utility fails to correctly validate the available space, which can lead to data corruption. The vulnerability has been assigned a CVSS v3.1 base score of 4.4 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, indicating local access is required and high privileges are needed to exploit the vulnerability (NVD).

The exploitation of this vulnerability can result in permanent loss of stored information. When an attacker with the necessary permissions writes a large amount of metadata to an encrypted device, it can cause the metadata to overwrite and corrupt the user's encrypted data (Redhat Bugzilla).