CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file

CVE-2026-72103: dm: avoid leaking the caller's thread keyring via the table device file

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dm: avoid leaking the caller's thread keyring via the table device file

The refactoring in commit a28d893eb327 ("md: port block device access to file")
accidentally causes the caller's thread keyring to be kept alive long
beyond the caller's lifetime.

As a result, "cryptsetup luksSuspend" silently fails to wipe the
LUKS volume key from memory.

In detail: "cryptsetup luksOpen" uses its supposedly ephemeral thread
keyring to pass the volume key to the kernel. dm-crypt's
crypt_set_keyring_key() copies the key material into its own
crypt_config structure and then drops its own reference to the key in
the keyring with key_put().

With this fix, restoring pre-v6.9 behavior, the copy in the thread
keyring is then promptly garbage collected, such that exactly one copy
of the volume key remains. This single copy is correctly wiped from
memory on "cryptsetup luksSuspend".

Without this fix, the thread keyring and the volume key in it remains.
This second copy is only freed on "luksClose". "luksSuspend" neither
knows about this copy nor has any way to remove it, so the key remains
recoverable from RAM after a suspend that is documented to have wiped it.

This fix should not introduce new security problems, as the code is
anyway gated by CAP_SYS_ADMIN. The device-mapper core, not the calling
task, is the legitimate owner of this long-lived file.

The Linux kernel CVE team has assigned CVE-2026-72103 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.9 with commit a28d893eb3270cf62c10dd8777af0d8452cdc072 and fixed in 6.12.101 with commit d3eb8451d529ea452740d1a2bc395a1d20c48133
	Issue introduced in 6.9 with commit a28d893eb3270cf62c10dd8777af0d8452cdc072 and fixed in 6.18.42 with commit 8ced1d242c34e342defcccdb00663354f212aae6
	Issue introduced in 6.9 with commit a28d893eb3270cf62c10dd8777af0d8452cdc072 and fixed in 7.1.5 with commit f00105be6a593920e9bc7949a069d4a116888851
	Issue introduced in 6.9 with commit a28d893eb3270cf62c10dd8777af0d8452cdc072 and fixed in 7.2-rc3 with commit 981ccd97f7153d310dfa92a534525bbaf46752c2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72103
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/dm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d3eb8451d529ea452740d1a2bc395a1d20c48133
	https://git.kernel.org/stable/c/8ced1d242c34e342defcccdb00663354f212aae6
	https://git.kernel.org/stable/c/f00105be6a593920e9bc7949a069d4a116888851
	https://git.kernel.org/stable/c/981ccd97f7153d310dfa92a534525bbaf46752c2