Rocky Linux 8 [CIQ] Security Update: cryptsetup / cryptsetup-debuginfo / cryptsetup-debugsource / etc (crlsa-2022_0370)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20220370 advisory. cryptsetup: disable encryption via header rewrite CVE-2021-4122 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

CVE-2025-71422

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

CVE-2025-71422

The Contrast Kubernetes runtime for confidential containers is vulnerable in versions before 1.12.1 . A malicious host can supply a crafted LUKS2 volume to a pod VM. Because LUKS2 volume metadata is not authenticated and older cryptsetup versions (prior to 2.8.1) accept null keyslot encryption al...

CVE-2025-71422

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

CVE-2025-71422 Contrast before 1.12.1 Insecure LUKS2 Persistent Storage

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

EUVD-2025-211010

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

CVE-2025-71422 Contrast before 1.12.1 Insecure LUKS2 Persistent Storage

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

CVE-2025-71422: Improper Verification of Cryptographic Signature

Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a malicious host supplying a crafted LUKS2 volume to a pod VM. LUKS2 volume metadata is not authenticated and, with cryptsetup versions prior to 2.8.1, a...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: cryptsetup (UTSA-2026-030644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-030644 advisory. It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical acces...

CVE-2026-72103

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

UBUNTU-CVE-2026-72103

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

CVE-2026-72103

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

CVE-2026-72103 dm: avoid leaking the caller's thread keyring via the table device file

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

CVE-2026-72103

CVE-2026-72103 relates to the Linux kernel’s dm-crypt flow. A refactoring bug caused the caller’s thread keyring to be kept alive beyond the caller’s lifetime, making the LUKS volume key linger in memory. As a result, cryptsetup luksSuspend could fail to wipe the key, even though luksOpen passes ...

CVE-2026-72103 dm: avoid leaking the caller's thread keyring via the table device file

In the Linux kernel, the following vulnerability has been resolved: dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 "md: port block device access to file" accidentally causes the caller's thread keyring to be kept alive long beyond th...

PT-2026-72292

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.9 and later Description A refactoring in the device-mapper dm component causes the caller's thread keyring to persist beyond the caller's lifetime. This occurs when cryptsetup luksOpen uses a thread keyring to pass a...

SUSE SLES16: cryptsetup / cryptsetup-doc / cryptsetup-lang / cryptsetup-ssh / etc (SUSE-SU-2026:22645-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22645-1 advisory. Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's...

openSUSE 16: cryptsetup / cryptsetup-lang / cryptsetup-ssh / libcryptsetup-devel / etc (openSUSE-SU-2026:21325-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21325-1 advisory. Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's credentials when t...

SUSE-SU-2026:22645-1 Security update for cryptsetup

This update for cryptsetup fixes the following issues: Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's credentials when the kernel opens a file. This is due to the refactoring in kernel commit a28d893eb327 "md:...

SUSE-SU-2026:22602-1 Security update for cryptsetup

This update for cryptsetup fixes the following issues: Changes in cryptsetup: - Fix for bsc1270254 to avoid undesired pinning of all volume keys via the thread keyring through the caller's credentials when the kernel opens a file. This is due to the refactoring in kernel commit a28d893eb327 "md:...