A flaw in the luksmeta module (a CWE‑1284 boundary error) allows a local attacker with administrative privileges to corrupt LUKS device metadata. The vulnerability stems from incorrect calculations of free space boundaries and deficient overlap detection, which means that when new metadata records are written, they can exceed the reserved area or overwrite existing entries. This can lead to corruption of stored encrypted payloads or compromise the integrity of the metadata itself, potentially rendering the affected data inaccessible.

Red Hat Enterprise Linux 10, 7, 8, and 9 as well as Red Hat OpenShift Container Platform 4, all of which rely on the luksmeta utility for LUKS 1 device metadata management, are affected. Versions shipped with these platforms contain the vulnerable code; no specific patch or version threshold is listed, meaning all supported releases that include the current library are vulnerable until a fix is released.

The CVSS score of 5.1 classifies the issue as moderate. EPSS is not available, so current exploit probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires local administrative access, the attack surface is limited to systems where a malicious user can obtain such privileges; the attack path involves modifying LUKS metadata, after which corrupted data may cause data loss. With no patch or workaround from Red Hat, the risk remains until a vendor fix is released.