Cryptographic Key Retention in Memory During LUKS Suspend Since Linux 6.9
Since the release of Linux kernel version 6.9, the LUKS suspend process has ceased wiping disk-encryption keys from system memory. This regression, identified during an investigation by researcher Ingo Blechschmidt, leaves sensitive cryptographic material resident in RAM.
Cryptographic Key Retention in Memory
The core security guarantee of the Linux Unified Key Setup (LUKS) suspend state relies on purging disk-encryption keys from RAM. This mechanism prevents the retrieval of cryptographic material from physical memory when a system is in a suspended state.
Following the release of Linux kernel 6.9, this purging mechanism has failed. The LUKS suspend routine ceases to wipe these disk-encryption keys, leaving the sensitive cryptographic material resident in memory.
Reported Scope and Observations
The regression specifically impacts systems running Linux kernel version 6.9 and subsequent releases utilizing LUKS suspend configurations. Researcher Ingo Blechschmidt documented this behavior following an in-depth, multi-day technical investigation into the anomaly.
The failure to clear these keys from memory under the suspend state undermines the primary physical security control intended for suspended encrypted volumes.