Linux 6.9 silently broke LUKS suspend's in-memory key wiping

The whole point of cryptsetup’s luksSuspend is to flush a LUKS volume and scrub its master key out of kernel RAM while the machine is locked or asleep — the defense that stops an attacker with brief physical access from recovering disk-encryption keys via cold-boot or DMA attacks on a running-but-suspended laptop. A regression introduced in Linux 6.9 quietly disabled that behavior: the suspend path no longer wipes the keys, so they linger in memory and remain extractable even after the volume is supposedly suspended.

What makes this dangerous is that it is silent. The command still succeeds and appears to work, but the security guarantee users depend on is gone, with no error or warning to signal that the protection has evaporated. Anyone who scripted luksSuspend into a lock or lid-close workflow to harden against evil-maid-style access has been running unprotected since 6.9 without knowing it.

The finding is a reminder that security features can rot invisibly across kernel refactors, and that the guarantees of a hardening step should be verified rather than assumed. Users relying on luksSuspend on affected kernels should treat their keys as resident in RAM and confirm whether their kernel version restores the wiping behavior before trusting it again.