CVE-2026-72103

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.9 and later

Description A refactoring in the device-mapper (dm) component causes the caller's thread keyring to persist beyond the caller's lifetime. This occurs when cryptsetup luksOpen uses a thread keyring to pass a volume key to the kernel; while the crypt set keyring key() function copies the key material into the crypt config structure and calls key put(), the thread keyring is not properly garbage collected. Consequently, when cryptsetup luksSuspend is executed, it fails to wipe the LUKS volume key from memory because a second copy remains in the thread keyring. This copy is only released during luksClose, leaving the key recoverable from RAM after a suspend operation. Access to this functionality is restricted to users with CAP SYS ADMIN privileges.

Recommendations Update the Linux kernel to a version where this issue is resolved to ensure the thread keyring is correctly garbage collected and volume keys are properly wiped during suspend operations.