Repository navigation
luksmeta v11 Release Notes
Security
CVE-2026-107565: Incomplete gap-boundary and overlap checks in LUKS1 metadata allocator allow data corruption
- Fix the gap allocator's overlap() predicate to use canonical half-open interval intersection and pass the bare gap length (not offset-shifted) as the hard limit, preventing a fully-contained candidate range from evading the overlap check and corrupting adjacent slot data.
CVE-2026-111555: Missing slot-range validation permits out-of-gap device I/O
- Add an overflow-safe check in read_header() that the complete occupied slot range (offset + length) fits within the metadata gap, preventing a checksum-valid malformed header from directing luksmeta_load() or luksmeta_wipe() to perform I/O past the gap boundary.