Executive brief
The Linux kernel's crash dump functionality for dm-crypt (a disk encryption system) contains a resource management bug that can trigger system warnings or instability when multiple encrypted keys are restored during kernel crash recovery. This occurs in the kernel's crash dump code path and could affect systems using encrypted disks with multiple keys during emergency kernel dumps.
Technical details
The vulnerability is a reference count management error (use-after-free / refcount underflow) in the crash_dump_dm_crypt.c kernel module. The function restore_dm_crypt_keys_to_thread_keyring() acquires a keyring reference but then passes it to add_key_to_keyring(), which incorrectly drops the reference on each call. When more than one key is restored, the reference is dropped multiple times, causing a refcount underflow. Additionally, early error paths fail to release the reference. The fix centralizes reference ownership in the parent function and removes the erroneous drop from add_key_to_keyring(). The vulnerability is triggered only when multiple dm-crypt keys are present and the crash dump code path is executed.
Affected products
- Linux Linux Kernel affected in crash_dump code (patched in 2026-07-04)
Timeline
- 2026-09-17: disclosed
- 2026-07-04: patched: Fix committed by Guangshuo Li