CVE-2026-31543

Vulnerability

In the Linux kernel's crash_dump subsystem, the function read_key_from_user_keying() logs the first 8 bytes of the dm-crypt key payload when debug logging is enabled [1]. This exposes part of the symmetric key used for disk encryption.

Exploitation

Exploitation requires that debug logging is enabled in the kernel, which is not the default but may be turned on by administrators for troubleshooting. An attacker with local access to system logs (e.g., via dmesg or log files) can read the exposed key bytes.

Impact

A local attacker who can read kernel log messages can recover the first 8 bytes of the dm-crypt key. While not the full key, this reduces the key space and aids in brute-force attacks or cryptanalysis.

Mitigation

The fix, committed as stable kernel patches [1][2][3], removes all key bytes from debug logging. Users should apply these patches or disable debug logging for crash_dump. No workaround other than patching is available.