The udisks storage management daemon exposes a privileged D‑Bus API that permits restoration of LUKS encryption headers without performing an authorization check. An unprivileged user can therefore instruct the root‑owned udisks process to overwrite encryption metadata on any block device, which can permanently invalidate the key used to decrypt that volume. The consequence is a denial‑of‑service that manifests as irrecoverable data loss, because once the header is corrupt the volume can no longer be decrypted and its data becomes inaccessible.

The vulnerability affects Red Hat Enterprise Linux releases 6, 7, 8, 9, 10, and the 10.0 Extended Update Support line, as well as the freedesktop udisks package version 2.0.0. Systems running any of these operating system releases with the affected udisks package are impacted.

The vulnerability carries a CVSS score of 7.1 and an EPSS score below 1 %, indicating a high severity and a low probability of exploitation in the wild. The flaw is a local privilege escalation vector, requiring an attacker to have a user account on the system; no network or privileged exploitation is necessary. Interaction with the D‑Bus interface is straightforward, and the lack of an authorization check removes a critical security boundary. The issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no documented exploitation as of this analysis.