Incomplete cleanup in Linux kernel - CVE-2026-72103
Published: August 16, 2026
Vulnerability identifier: #VU143490
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72103
CWE-ID: CWE-459
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to recover sensitive key material from memory.
The vulnerability exists due to improper lifetime management in the table device file handling in drivers/md/dm.c when opening a backing device. A local privileged user can invoke cryptsetup operations that leave an extra copy of the LUKS volume key in the thread keyring to recover sensitive key material from memory.
The issue is gated by CAP_SYS_ADMIN, and the residual key material may remain recoverable from RAM after a luksSuspend operation.
Affected software
Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
How to mitigate CVE-2026-72103
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1