CVE-2021-4122: Cryptsetup Project Cryptsetup

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.

Affected products

• Cryptsetup Project Cryptsetup: before 2.3.7 (fixed in 2.3.7); from 2.4.0, before 2.4.3 (fixed in 2.4.3)

Published 2022-08-24. Last modified 2026-06-17.