Linux kernel version 6.9 introduced a bug that prevented LUKS encryption keys from being cleared from memory when a laptop entered suspend mode. A one‑line patch submitted by a contributor will restore the original behavior of wiping the keys on suspend.

Full‑disk encryption such as LUKS protects data if a device is lost or stolen, but the encryption key must be removed from RAM before the system suspends. Prior to the issue, the key remained resident, creating a potential exposure through cold‑boot attacks.

The problem originated from a refactoring of block‑device access in the kernel commit a28d893eb3270cf62c10dd8777af0d8452cdc072, which altered how the kernel handles device access during suspend. As a result, the cryptsetup tool that locks the drive on suspend stopped invoking the code that wipes the key. The fix, also a single line change, re‑introduces the key‑wiping routine and adds a warning if the operation fails. An automated test in the NixOS repository (pull request #532499) will detect future regressions. Community members on a public forum identified the issue while debugging their own systems, reproduced the problem in a virtual machine, and confirmed that the key persisted in memory after suspend. They noted that the original patch by Pali Rohár had addressed the same concern in an earlier, unmerged kernel submission. While some discussion questioned the practical exploitability of the flaw — citing modern memory encryption and the rarity of cold‑boot attacks — the consensus was that the risk is sufficient to merit a security fix. The maintainer of the cryptsetup project merged the warning patch, and the kernel community accepted the change. The update will be included in upcoming Linux releases.

The change ensures that LUKS volumes are securely cleared on suspend, aligning the kernel’s behavior with the expectation that encryption keys should not remain accessible after a system is put to sleep.