CVE-2026-72103 exposes a silent security regression in how the kernel handles thread keyring lifetime after dm-crypt operations. When cryptsetup calls luksSuspend, it expects the volume key to be wiped from memory after the operation completes. The call returns success. The operator has no indication that the key actually remains in a memory location the suspend path can no longer reach.
The root cause is commit a28d893eb327 ('md: port block device access to file'), a cosmetic subsystem refactor that inadvertently changed object ownership semantics. The thread keyring — used as a transient vessel for passing key material to dm-crypt — was meant to be ephemeral, garbage-collected after the operation. The refactor gave it permanent residency in the dm-core table device file. The regression is invisible: luksSuspend returns success, the kernel raises no error, and the operator receives no signal that their security-critical operation failed to achieve its documented effect.
The fix restores pre-v6.9 behavior, but this reveals the deeper problem. The security property was accidental — an implicit contract that existed because of how the code happened to work, not because anyone documented it. Thread keyring lifetime semantics were never encoded as a kernel API guarantee. When the md/dm subsystem refactored block device access patterns, nobody reviewed that diff against cryptsetup's assumptions about key material lifetime.
This fits a recurring pattern. The keyring subsystem has a documented history of lifetime-migration vulnerabilities from subsystem refactoring — CVE-2010-3760, CVE-2012-2107, and the keyctl series from 2019-2021 all involved thread keyring semantics violated through innocent code changes. Each fix restores 'what worked before' without encoding an explicit lifetime contract. The disease isn't one bad commit; it's interfaces with undocumented security contracts that survive refactoring only by architectural coincidence.
Defensive posture: any userspace tool using thread keyrings as ephemeral transit vessels for sensitive material should be considered potentially exposed to lifetime semantics changes. The kernel has no mechanism to signal lifetime contract violations to callers — this is a structural gap. Review processes for subsystem refactoring need cross-boundary dependency tracking that most kernel development workflows don't currently perform. The real question isn't whether this CVE gets patched; it's whether implicit security contracts across subsystem boundaries can ever be made explicit enough to survive the next refactor.