{"id":"SUSE-SU-2026:22602-1","aliases":[],"status":"published","title":"Security update for cryptsetup","description":"This update for cryptsetup fixes the following issues:\n\nChanges in cryptsetup:\n\n- Fix for (bsc#1270254) to avoid undesired pinning of all volume\n  keys (via the thread keyring) through the caller's credentials\n  when the kernel opens a file. This is due to the refactoring in\n  kernel commit a28d893eb327 (\"md: port block device access to file\")\n  that accidentally causes the caller's thread keyring to be kept\n  alive long beyond the caller's lifetime, the kernel part is tracked\n  in (bsc#1270252).\n\n  * Add keyring key type. [b6fb6fc0]\n  * Load volume keys in intermediary keyring linked in thread\n    keyring. [413a3dd0]\n  * Use unique intermediary keyring name per device. [04ef07a7]\n  * Add regression tests. [bfcb0c38, bb5e8e9f, e6573494, aa214c09]","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-13T16:23:40Z","modified":"2026-07-16T18:24:39Z","fixes":[{"ecosystem":"SUSE:Linux Micro 6.2","package":"cryptsetup","fixed_in":["2.8.4-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"cryptsetup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.2.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622602-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270252","tags":["report"]},{"url":"https://bugzilla.suse.com/1270254","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2026:22602-1","title":"Security update for cryptsetup","description":"This update for cryptsetup fixes the following issues:\n\nChanges in cryptsetup:\n\n- Fix for (bsc#1270254) to avoid undesired pinning of all volume\n  keys (via the thread keyring) through the caller's credentials\n  when the kernel opens a file. This is due to the refactoring in\n  kernel commit a28d893eb327 (\"md: port block device access to file\")\n  that accidentally causes the caller's thread keyring to be kept\n  alive long beyond the caller's lifetime, the kernel part is tracked\n  in (bsc#1270252).\n\n  * Add keyring key type. [b6fb6fc0]\n  * Load volume keys in intermediary keyring linked in thread\n    keyring. [413a3dd0]\n  * Use unique intermediary keyring name per device. [04ef07a7]\n  * Add regression tests. [bfcb0c38, bb5e8e9f, e6573494, aa214c09]\n","status":"published","published":"2026-07-13T16:23:40Z","modified":"2026-07-16T18:24:39.0242072Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}