Linux dm Bug Silently Breaks LUKS Key Wipe

cryptsetup luksSuspend is supposed to evict the LUKS volume key from kernel memory — that’s the contract. CVE-2026-72103, published to NVD on August 15, documents that it has been silently breaking that contract on kernels carrying commit a28d893eb327.

The commit in question, titled “md: port block device access to file,” was refactoring work. It didn’t touch any obvious security boundary. What it did, as identified in the stable fix, was accidentally keep the caller’s thread keyring alive longer than intended when device-mapper opens a table device file. cryptsetup luksOpen stores the LUKS volume key in what’s supposed to be an ephemeral thread keyring. After the refactor, a reference to that keyring lingers beyond the caller’s lifetime. The key lingers with it.

luksSuspend returns without error. Nothing in the output tells you it didn’t work. That’s the part that matters most — the failure mode is silent.

Who’s affected

Users and automation relying on luksSuspend for volume-key hygiene: screen-lock workflows, pre-suspend scripts, or anything that expects the volume key to be gone before entering a state where local memory access is possible. If your setup never calls luksSuspend, this doesn’t affect you. The bug has no remote attack surface.

Status

No CVSS score has been assigned by NVD as of August 16. Severity is assessed at medium — locally exploitable failure of a disk-encryption security guarantee — pending formal NVD assignment. No exploitation in the wild has been reported. No CISA KEV addition as of publication.

Patch

Fixed in Linux stable. Commit: git.kernel.org — CVE-2026-72103. Update the kernel. If you run automated luksSuspend in a screen-lock or hibernation workflow, prioritize this.

The irony is predictable in retrospect: a change specifically about how file access works inside device-mapper quietly invalidated a property that LUKS users probably never thought to recheck. Refactoring regressions landing on security invariants are not a new pattern. This one’s patched — time to ship it.

NVD: CVE-2026-72103. Part of the same August 15 stable batch as the brcmfmac WiFi heap overflow and BPF verifier bypass and the ksmbd stack overflow fix.