Linux dm keyring leak causes silent LUKS volume key wipe failure

Refactoring commit a28d893eb327 (“md: port block device access to file”) accidentally caused the caller’s thread keyring to be held alive beyond the caller’s lifetime when device-mapper opens a table device file. cryptsetup luksOpen stores the LUKS volume key in what is supposed to be an ephemeral thread keyring. After the refactor, a reference to that keyring — and the key it contains — outlives the caller.

Impact: cryptsetup luksSuspend completes without error but silently fails to wipe the LUKS volume key from kernel memory. Users and automated workflows relying on luksSuspend for key hygiene — screen-lock or pre-suspend scenarios — are affected. The key remains in memory when it should not.

Affected: Linux systems running kernels that include commit a28d893eb327 and have not received the fix commit. The bug has no remote attack surface.

Patch: CVE-2026-72103 stable fix — git.kernel.org. Update to latest stable kernel.

No CVSS score assigned by NVD as of 2026-08-15. Severity designation (medium) reflects the described impact — locally exploitable failure of a disk-encryption security guarantee — pending NVD assignment. No exploitation in the wild confirmed. No CISA KEV addition as of publication.

Source: NVD — CVE-2026-72103