Missing Authorization in udisks - CVE-2026-26104

Vulnerability identifier: #VU123339

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-26104

CWE-ID: CWE-862

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to missing authorization. A local user can cause udisksd (root) to read and export a LUKS header.

udisks
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Anolis OS
Fedora
libudisks2
libudisks2-devel
udisks2
udisks2-iscsi
udisks2-lsm
udisks2-lvm2
udisks2-doc
udisks2 (Red Hat package)

Install updates from vendor's website.

udisks - update to 2.11.1
libudisks2 - update to 2.10.90-5
libudisks2-devel - update to 2.10.90-5
udisks2 - update to 2.10.90-5
udisks2-iscsi - update to 2.10.90-5
udisks2-lsm - update to 2.10.90-5
udisks2-lvm2 - update to 2.10.90-5
udisks2-doc - update to 2.10.90-5
udisks2 (Red Hat package) - addressed in versions 2.10.90-5.el10_0.2, 2.10.90-6.el10_1.1
udisks2 - addressed in versions 2.11.1-1.fc43, 2.11.1-1.fc44

• https://github.com/storaged-project/udisks/security/advisories/GHSA-fcvx-497g-6xmw

• Multiple vulnerabilities in udisks
• Fedora 44 update for udisks2
• Fedora 43 update for udisks2
• Red Hat Enterprise Linux 10 update for udisks2
• Anolis OS update for udisks2
• Red Hat Enterprise Linux 10 update for udisks2