Public bug reported:
After updating to the kernel version 7.0.0-28 on Ubuntu 24.04, I
encountered a severe regression with unlocking LUKS-encrypted
secondary/non-boot drives using standard cryptsetup tools.
When attempting to open a LUKS container normally, the command fails with the
following error:
"IO error while decrypting keyslot. keyslot open failed."
This appears to be related to the upstream Linux kernel 7.x regression
in the direct-I/O read path/crypto API during metadata processing
directly from the device. The root partition itself decrypts fine during
initramfs stage, but any secondary partitions fail after full boot.
*** WORKAROUND ***
The issue can be completely bypassed by using a detached/exported LUKS header.
If the header is saved into a separate file, the drive can be successfully
unlocked with the following command:
sudo cryptsetup luksOpen --header <headerfile> <device> <volume>
This confirms that the data area itself is intact and readable by the
kernel, but the direct metadata read from the disk container triggers an
IO error in this specific kernel version.
Steps to reproduce:
1. Boot into kernel 7.0.0-28.
2. Try to unlock any secondary LUKS-encrypted partition via 'sudo cryptsetup
luksOpen /dev/sdX name'.
3. Observe the "IO error while decrypting keyslot" failure.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-7.0.0-28-generic 7.0.0-28.28~24.04.1
ProcVersionSignature: Ubuntu 7.0.0-28.28~24.04.1-generic 7.0.12
Uname: Linux 7.0.0-28-generic x86_64
ApportVersion: 2.28.2-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: ovl 2564 F.... pipewire
ovl 2567 F.... wireplumber
/dev/snd/seq: ovl 2564 F.... pipewire
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Sat Jul 18 23:01:10 2026
InstallationDate: Installed on 2024-08-10 (707 days ago)
InstallationMedia: Ubuntu 24.04 LTS "Noble Numbat" - Release amd64 (20240424)
MachineType: LENOVO 21HD005BRT
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-28-generic
root=UUID=ab3e3d13-3c36-4a66-a0e5-784d9518fa2c ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
vt.handoff=7
RelatedPackageVersions:
linux-restricted-modules-7.0.0-28-generic N/A
linux-backports-modules-7.0.0-28-generic N/A
linux-firmware 20240318.git3b128b60-0ubuntu2.27
SourcePackage: linux-hwe-7.0
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 11/22/2023
dmi.bios.release: 1.40
dmi.bios.vendor: LENOVO
dmi.bios.version: N3QET40W (1.40 )
dmi.board.asset.tag: Not Available
dmi.board.name: 21HD005BRT
dmi.board.vendor: LENOVO
dmi.board.version: Not Defined
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.10
dmi.modalias:
dmi:bvnLENOVO:bvrN3QET40W(1.40):bd11/22/2023:br1.40:efr1.10:svnLENOVO:pn21HD005BRT:pvrThinkPadT14Gen4:rvnLENOVO:rn21HD005BRT:rvrNotDefined:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21HD_BU_Think_FM_ThinkPadT14Gen4:pfaThinkPadT14Gen4:
dmi.product.family: ThinkPad T14 Gen 4
dmi.product.name: 21HD005BRT
dmi.product.sku: LENOVO_MT_21HD_BU_Think_FM_ThinkPad T14 Gen 4
dmi.product.version: ThinkPad T14 Gen 4
dmi.sys.vendor: LENOVO
** Affects: linux-hwe-7.0 (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161212
Title:
Regression in kernel 7.0.0-28: cryptsetup fails with "IO error while
decrypting keyslot. keyslot open failed"
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-hwe-7.0/+bug/2161212/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
