CVE-2026-26103: 
NixOS vulnerability analysis and mitigation

CVE-2026-26103 is a missing authorization vulnerability in the udisks storage management daemon that allows a local unprivileged user to restore LUKS encryption headers on arbitrary block devices without authentication. The flaw was reported on January 28, 2026, publicly disclosed on February 25, 2026, and affects udisks2 versions >= 2.10.90 (patched in 2.11.1) as well as Red Hat Enterprise Linux 10.0. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, GitHub Advisory).

The root cause is a missing authorization check (CWE-862) in the handle_restore_encrypted_header() function of the udisks daemon. Specifically, the handler for the org.freedesktop.UDisks2.Block.RestoreEncryptedHeader D-Bus method omits the required call to udisks_daemon_util_check_authorization_sync(), meaning any local user with access to the system D-Bus can invoke this privileged method without polkit authorization. The root-owned udisksd process then calls bd_crypto_luks_header_restore() on any attacker-specified block device, destructively overwriting its LUKS header and keyslots. Notably, the handler does not verify that the target device is actually a LUKS volume, so it can also clobber non-LUKS block devices by writing LUKS metadata to them (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation permanently invalidates LUKS encryption keys and keyslots on targeted block devices, rendering encrypted volumes completely inaccessible and causing irreversible data loss unless a prior header backup exists. The attack results in a denial-of-service condition with high integrity and availability impact, as the original passphrase will no longer function and the volume is effectively bricked. Because the handler does not restrict targets to LUKS devices, an attacker could also corrupt non-LUKS block devices by overwriting them with LUKS metadata. There is no confidentiality impact, as the vulnerability does not expose data — it destroys access to it (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Red Hat CVE). The vulnerability requires only low privileges (a local user account) and no user interaction, making it straightforward to exploit once an attacker has local access. The EPSS score is approximately 0.007% (0.000070), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Gain local access: Obtain a local unprivileged user account on a system running a vulnerable version of udisks2 (>= 2.10.90, unpatched).
2. Identify target block device: Enumerate available block devices (e.g., using lsblk or ls /dev/) to identify a LUKS-encrypted volume or any block device to target for destruction.
3. Prepare a malicious LUKS header backup file: Create or obtain a file containing a crafted or arbitrary LUKS header (e.g., a zeroed file or a header from a different device) to use as the restore source.
4. Invoke the vulnerable D-Bus method: Call the org.freedesktop.UDisks2.Block.RestoreEncryptedHeader method on the system D-Bus, specifying the target block device object path and the path to the malicious backup file. This can be done using tools such as gdbus or dbus-send:

   gdbus call --system --dest org.freedesktop.UDisks2 \
     --object-path /org/freedesktop/UDisks2/block_devices/sdb \
     --method org.freedesktop.UDisks2.Block.RestoreEncryptedHeader \
     '/path/to/fake_header.bin' '{}'

5. Achieve denial of service: The root-owned udisksd daemon overwrites the LUKS header and keyslots on the target device without any authorization check, permanently destroying access to the encrypted volume (Red Hat Bugzilla, GitHub Advisory).

• Logs: System journal entries (journalctl -u udisks2) showing invocations of RestoreEncryptedHeader D-Bus method by non-root, non-administrative users; audit log entries (/var/log/audit/audit.log) recording D-Bus method calls to org.freedesktop.UDisks2.Block.RestoreEncryptedHeader from unexpected UIDs.
• File System: Sudden inaccessibility of previously functional LUKS-encrypted volumes; cryptsetup luksDump on a block device returning errors or showing unexpected/zeroed header data indicating header corruption.
• Process: Unexpected invocations of bd_crypto_luks_header_restore within the udisksd process, observable via process tracing tools (e.g., strace, auditd syscall monitoring) initiated by low-privilege user sessions.
• D-Bus: D-Bus monitor logs (dbus-monitor --system) capturing RestoreEncryptedHeader method calls originating from unprivileged user sessions.

Red Hat has released patched packages for RHEL 10 via security advisories RHSA-2026:3476 (issued March 2, 2026, package version udisks2-2.10.90-6.el10_1.1) and RHSA-2026:5831 (issued March 25, 2026, for RHEL 10.0 Extended Update Support, package version udisks2-2.10.90-5.el10_0.2). Upstream, the fix is available in udisks2 version 2.11.1. As a workaround on systems that cannot be immediately patched, administrators should restrict local user access to the system D-Bus or limit which users can interact with the udisks2 service via polkit rules. Monitoring D-Bus API calls for RestoreEncryptedHeader invocations from unprivileged users is recommended until patching is complete (RHSA-2026:3476, RHSA-2026:5831, GitHub Advisory).

The vulnerability was credited to researcher "manizada" in the upstream GitHub security advisory (GitHub Advisory). The storaged-project maintainer tbzatek published the advisory on February 25, 2026. Coverage appeared on Linux security news aggregators including linuxsecurity.com and linuxcompatible.org, and the issue was noted in Fedora and openSUSE update announcements as part of broader udisks2 security updates. Social media discussion was limited, with a brief mention on Bluesky. No significant controversy or broader industry debate has been observed.