SB20260816426 - Incomplete cleanup in Linux kernel md driver

Description

This security bulletin contains information about 1 vulnerability.

1) Incomplete cleanup (CVE-ID: CVE-2026-72103)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to recover sensitive key material from memory.

The vulnerability exists due to improper lifetime management in the table device file handling in drivers/md/dm.c when opening a backing device. A local privileged user can invoke cryptsetup operations that leave an extra copy of the LUKS volume key in the thread keyring to recover sensitive key material from memory.

The issue is gated by CAP_SYS_ADMIN, and the residual key material may remain recoverable from RAM after a luksSuspend operation.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8ced1d242c34e342defcccdb00663354f212aae6
• https://git.kernel.org/stable/c/981ccd97f7153d310dfa92a534525bbaf46752c2
• https://git.kernel.org/stable/c/d3eb8451d529ea452740d1a2bc395a1d20c48133
• https://git.kernel.org/stable/c/f00105be6a593920e9bc7949a069d4a116888851