A subtle but significant security flaw in Linux's full-disk encryption (LUKS) went unnoticed since the release of kernel 6.9 in May 2024. The issue, discovered by Ingo Blechschmidt, meant that the encryption key remained in memory across suspend cycles, leaving it vulnerable if a laptop was seized while powered on. This undermines the core purpose of LUKS for data protection.

Blechschmidt traced the bug to a code refactoring within the kernel that had an unintended interaction with the encryption handling. While the fix is a single line of code, its delayed detection highlights the challenges of verifying complex software. The vulnerability meant that users relying on LUKS for laptop security might have been exposed for over two years, with only a full shutdown providing complete protection.

While a precise formal proof of the fix's correctness is pending, immediate steps have been taken. Automated tests are now in place to catch similar regressions in the future, and a patch has been submitted to emit warnings rather than silently failing. This incident underscores the need for continuous vigilance and robust testing in system-level security code.