udisks2-2.11.1

[Bruce Dubbs]

New point version.

[Xi Ruoyao]

This is a bugfix release, fixing ATA USB device detection regression, leaking systemd inhibitors and missing polkit checks (CVE-2026-26103, CVE-2026-26104).

Changes since 2.11.0:

Tomas Bzatek (8):

• lvm2: Prevent a segfault on discarded probe output
• udiskslinuxdevice: Fix ATA USB detection
• udiskslinuxnvmecontroller: Fix sanitize job start
• udiskslinuxpartition: Fix missing job completion in handle_set_name
• udiskslinuxpartitiontable: Fix missing job completion on overlapping partition error
• udiskslinuxmanagernvme: Fix UINT64 variant handling in fabrics extra options
• udiskslinuxblock: Add missing polkit check for RestoreEncryptedHeader()
• udiskslinuxencrypted: Add missing polkit check for HeaderBackup()

Vojtech Trefny (4):

• docs: Update links to documentation on storaged.org
• udiskslinuxmdraid: Fix getting bitmap location on latest kernels
• udisksobjectinfo: Fix compiler warning with C23
• tests: Do not mount the loop device for SetAutoclear test

[Douglas R. Reno]

CVE-2026-26103 is rated as High. The details: "The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss."

Note: Successful exploitation results in a denial-of-service condition through irreversible data loss.

CVE-2026-26104 is rated as Medium. "The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes."

[Joe Locash]

Fixed at 85fd669e29.

Leaving open for SA.

[zeckma]

I'll handle the SA.

[zeckma]

SA-12.4-110 issued.