A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk…

luksmeta is a small Red Hat utility that stores arbitrary metadata in the unused header slots of a LUKS1 volume — most notably used by Clevis for network-bound disk encryption (NBDE/Tang). CVE-2025-11568 is an *improper input validation* (CWE-1284) bug where the tool fails to correctly bounds-check slot indices or sizes, and on a LUKS1 header it can overwrite adjacent slot metadata. The affected component is the standalone luksmeta binary and library; LUKS2 volumes use a different on-disk metadata layout and are not impacted. Affected packages: luksmeta ≤ upstream HEAD prior to the October 2025 fix and the corresponding RHEL/Fedora rebuilds.

Vendor MEDIUM (4.4) is a defensible label on the CVSS calculator — AV:L/AC:L/PR:H/UI:N/C:N/I:H/A:N is literally a 4.4 — but in operational reality this is a LOW. PR:H means the attacker is already root on the box and has the LUKS passphrase or keyfile. Anyone who can run luksmeta against a header can already run cryptsetup luksErase, dd if=/dev/zero of=/dev/sdX, or simply unlock and tamper with the filesystem. The CVSS Integrity:High rating reflects header corruption, but the marginal capability over what the attacker already possesses is zero.

Why this verdict

• Friction — attacker is already root with the key: the bug grants no new capability over dd or cryptsetup luksErase. Redundant capability is not a vulnerability worth ranking as MEDIUM.
• Friction — LUKS1 only: Fedora, RHEL 8.2+, Ubuntu 18.10+, and Debian 11+ default to LUKS2. The exposed substrate is shrinking and is rare in greenfield deployments.
• Friction — niche package: luksmeta is installed almost exclusively where Clevis NBDE was provisioned. EPSS 0.00093 reflects market disinterest correctly.
• Role multiplier: Even on a high-value role host (e.g., a Tang server itself, or an encrypted DB host), the chain ends in availability loss of one volume, recoverable from a header backup. It does not pivot to fleet, identity, or supply chain. No role floor is triggered.
• No KEV, no PoC weaponization, no network reachability — three independent corroborating signals that this is operationally LOW.

Why not higher?

MEDIUM would imply meaningful added risk over existing root privilege. There is none — the attacker who can trigger this can already destroy or read the volume directly. No role multiplier applies because the affected component is not a hypervisor, IdP, PAM, or kernel-mode agent; it is a userspace metadata helper.

Why not lower?

IGNORE would be wrong because the bug is real, the fix is straightforward, and unattended automation (e.g., poorly written Clevis wrappers) could trigger header corruption without malicious intent. Patch it on the normal hygiene cadence — don't pretend it isn't there.

1. Back up LUKS headers fleet-wide — Run cryptsetup luksHeaderBackup --header-backup-file <path> <device> on every encrypted volume and store off-host. This neutralizes the entire impact of CVE-2025-11568 and protects you against unrelated header corruption. No mitigation SLA applies for LOW — fold this into your standard 365-day backlog, but the header backup is good hygiene regardless.
2. Inventory LUKS1 vs LUKS2 volumes — Run cryptsetup luksDump <device> | grep Version across the fleet. Anything still on LUKS1 should be on the migration backlog independent of this CVE — LUKS1 has weaker KDFs and no redundant metadata. Convert with cryptsetup convert --type luks2 after backing up the header.
3. Restrict luksmeta invocation via sudoers — If luksmeta is on a host but only legitimately invoked by Clevis automation, deny interactive sudo luksmeta via a sudoers rule. Reduces the chance of accidental or malicious misuse to zero on those hosts.
4. Patch on next maintenance window — Apply the distro luksmeta errata during your standard monthly or quarterly window. Given LOW severity, no expedited change ticket is warranted.

Run on each target Linux host as root (or via your config-management agent). Example: sudo ./check_cve_2025_11568.sh. Reports VULNERABLE if luksmeta is installed at an unpatched version AND any local LUKS1 volume is present; PATCHED if either condition is absent or the patched build is detected.

#!/usr/bin/env bash
# check_cve_2025_11568.sh — luksmeta LUKS1 data corruption
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

if ! command -v luksmeta >/dev/null 2>&1; then
  echo "PATCHED: luksmeta not installed on this host"
  exit 0
fi

# Get installed version via package manager
ver=""
if command -v rpm >/dev/null 2>&1; then
  ver=$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' luksmeta 2>/dev/null | head -n1)
elif command -v dpkg-query >/dev/null 2>&1; then
  ver=$(dpkg-query -W -f='${Version}\n' luksmeta 2>/dev/null)
fi

if [ -z "$ver" ]; then
  echo "UNKNOWN: luksmeta present but version not resolvable"
  exit 2
fi

echo "INFO: luksmeta version detected: $ver"

# Check for any LUKS1 volumes on the host
luks1_found=0
if command -v lsblk >/dev/null 2>&1 && command -v cryptsetup >/dev/null 2>&1; then
  while read -r dev; do
    [ -b "/dev/$dev" ] || continue
    if cryptsetup isLuks "/dev/$dev" 2>/dev/null; then
      v=$(cryptsetup luksDump "/dev/$dev" 2>/dev/null | awk -F: '/Version/ {gsub(/ /,"",$2); print $2; exit}')
      if [ "$v" = "1" ]; then
        echo "INFO: LUKS1 volume found at /dev/$dev"
        luks1_found=1
      fi
    fi
  done < <(lsblk -ndo NAME)
fi

# Heuristic: check vendor errata marker (RHEL-style changelog tag)
patched=0
if command -v rpm >/dev/null 2>&1; then
  if rpm -q --changelog luksmeta 2>/dev/null | grep -qiE 'CVE-2025-11568|luks1.*bounds'; then
    patched=1
  fi
fi

if [ "$patched" -eq 1 ]; then
  echo "PATCHED: vendor errata for CVE-2025-11568 detected in changelog"
  exit 0
fi

if [ "$luks1_found" -eq 0 ]; then
  echo "PATCHED: no LUKS1 volumes on this host — bug unreachable"
  exit 0
fi

echo "VULNERABLE: unpatched luksmeta ($ver) present with LUKS1 volume — apply distro errata"
exit 1

Sources

1. NVD — CVE-2025-11568
2. Red Hat Security — CVE-2025-11568
3. luksmeta upstream (latchset/luksmeta)
4. CWE-1284 — Improper Validation of Specified Quantity in Input
5. cryptsetup / LUKS2 on-disk format
6. Clevis NBDE project
7. FIRST EPSS model
8. CISA KEV catalog