In the Linux kernel, a refactoring error left the caller’s thread keyring alive after a cryptsetup operation, so the encryption key used by dm‑crypt remains in memory. When cryptsetup runs luksSuspend, the key is not wiped from RAM, allowing a memory‑dump attacker to recover the LUKS volume key. The exposed key compromises the confidentiality of all data on the encrypted volume.

The vulnerability affects Linux kernel releases prior to the commit that restores pre‑v6.9 behavior. Devices using dm‑crypt with cryptsetup before the patch are susceptible. This issue is limited to kernels running on Linux operating systems.

The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. It requires CAP_SYS_ADMIN privileges to run cryptsetup luksSuspend, so only local attackers with administrative rights can attempt the exploit. A successful exploit would let them read the residual volume key from memory, enabling decryption of the encrypted disk. The CVSS score is 7.3, indicating a moderate to high severity, while the fix does not introduce new problems and is gated by administrative rights.