Linux 6.9+ 休眠时密钥未擦除
推荐指数 61.0 NO. 012 · 2026.07.03
发布2026/07/02Score276Comments134
为什么值得看
Linux 6.9 内核引入的回归 bug 导致 LUKS 磁盘加密在系统挂起/休眠时未清除内存中的主密钥，设备失窃后可被物理攻击提取。这是长达数月的安全漏洞，影响所有依赖 LUKS suspend 保护冷启动攻击的场景。
编辑判断
这个 bug 的特殊之处在于它破坏了 LUKS 最核心的安全假设：密钥仅在运行时驻留内存，休眠即销毁。攻击者现在可以针对休眠状态的笔记本进行 DMA 攻击或冷启动攻击，而企业安全团队往往假设 LUKS 已经覆盖了这层防护。
更麻烦的是 6.9 到 6.12 之间的内核版本广泛部署在 Ubuntu 24.04 LTS、Fedora 40+ 等主流发行版，很多云厂商的裸金属实例也在用。如果你的基础设施有合规要求（如 PCI-DSS 对休眠数据加密的条款），需要立刻审计内核版本和补丁状态，不能只看 LUKS 是否启用了。
社区反馈
负面 79 条评论
核心争论：内核回归漏洞导致密钥未擦除，用户误以为安全提示意味着密钥已清除
相关内容
I don't see any other way? When you sleep (suspend to RAM), everything is stored in RAM and is encrypted but the master key is present in kernel memory (if I recall correctly). However, if you hibernate (suspend to disk) the entire contents of RAM (including the master key) is written/encrypted
Yes, if you simply suspend your laptop on most stock Linux distributions, then everything including the master key is still kept in memory. But Debian pioneered the (optional) cryptsetup-suspend addon. This issues a luksSuspend command which is supposed to wipe the key from memory, and on resume ask
FYI: VeraCrypt is not the defacto encryption software for Windows.