CVE-2026-72103

A flaw was found in the Linux kernel's device-mapper (dm) component. A refactoring error caused the caller's thread keyring, which can contain sensitive data like LUKS volume keys, to persist in memory longer than intended. This issue allows a local attacker with administrative privileges to recover LUKS volume keys from system memory after a cryptsetup luksSuspend operation, which is designed to wipe these keys. This leads to an information disclosure vulnerability, compromising the confidentiality of encrypted data.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because exploitation requires local administrative privileges (CAP_SYS_ADMIN) or physical access to system memory, limiting the threat scope to already compromised or physically exposed environments. Under default enterprise deployments, device-mapper crypt devices retain sensitive cryptographic material only during active operational use, but suspended states fail to purge the cached thread keyring keys from RAM. Because unprivileged users cannot directly inspect kernel memory structures or invoke the relevant privileged operations, the flaw does not facilitate arbitrary privilege escalation or unauthorized remote access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.