# cryptsetup changelog > Cryptsetup and LUKS - open-source disk encryption - Vendor: cryptsetup - Category: Operating Systems - Official site: https://gitlab.com/cryptsetup/cryptsetup - Tracked by: What's New (https://whatsnew.fyi/product/cryptsetup) - Harvested from: Blog (https://gitlab.com/cryptsetup/cryptsetup/-/tags?format=atom) - Entries below: 15 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v2.8.7 - Date: 2026-07-21 - Version: v2.8.7 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.7 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.7 - Labels: Machine-generated from commit messages — the vendor published no release notes Version 2.8.7. - **added** — Add keyring key type and load volume keys in intermediary keyring linked in thread keyring. - **added** — Support Aria and Camellia ciphers in libgcrypt backend. - **added** — Add storage wrappers option to use DMCRYPT wrapper only and add fallback to dmcrypt in LUKS21 keyslot processing. - **added** — integritysetup: support --integrity-legacy-hmac in open. - **fixed** — Fix tcrypt, luks2, and OpenSSL backend security issues including safe allocation for password pool, length overflow checks, buffer size validation, HMAC return value checks, PBKDF2 cast overflow, and json keyslot leak on error path. - **fixed** — Fix reencryption name helper check and improve LUKS_check_cipher validation. - **changed** — Remove logic for AF_ALG dependence in tcrypt and luks2, and do not print specific AF_ALG info in cryptsetup cipher benchmark. - **changed** — Switch LUKS2 reencryption and convert code to more capable LUKS_check_cipher check. - **changed** — Allow cached volume key in activation with CRYPT_KC_TYPE_KEY only and ensure CRYPT_VOLUME_KEY_NO_SEGMENT flag always creates unbound keyslot. - **fixed** — Fix integrity shift overflow test and --tries option use. ### v2.8.7-rc2 - Date: 2026-07-10 - Version: v2.8.7-rc2 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.7-rc2 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.7-rc2 - Labels: Pre-release Version 2.8.7-rc2. ### v2.8.7-rc1 - Date: 2026-06-29 - Version: v2.8.7-rc1 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.7-rc1 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.7-rc1 - Labels: Pre-release Version 2.8.7-rc1 ### v2.8.6 - Date: 2026-04-02 - Version: v2.8.6 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.6 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.6 Version 2.8.6. ### v2.8.5 - Date: 2026-04-02 - Version: v2.8.5 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.5 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.5 - Labels: Machine-generated from commit messages — the vendor published no release notes Version 2.8.5. - **fixed** — UUID verification of resumed devices now matches UUID stored in metadata. - **fixed** — Reading from wrong image offset, fvault2 metadata block offset check, and LUKS2 reencryption lock and data offset functions. - **fixed** — crypt_resize() data leak on error path, wiping of larger Veracrypt password pool, and crypt_capi_to_cipher() prefix validation. - **fixed** — Kernel crypto backend sa.salg_type snprintf check, OpenSSL CTX_dup failure handling, device_alignment for NULL device, and DM_INTEGRITY union access in _reload_device(). - **fixed** — Keyring name buffer size in DM table with proper bounds checking, flags initialization to prevent reading uninitialized values on dm_flags() failure, and integrity sector size overflow from disk reads. - **fixed** — strtoll() failure checking, fvault2 key unwrapping memory allocation, OpenSSL RAND_bytes buffer size validation, and posix_fallocate error reporting. - **fixed** — Verity tree hash file flushing between levels and OpenSSL crypto backend build compatibility with LibreSSL. - **changed** — Use portable bitops.h instead of Linux endian.h in utf8.c and increased number of allowed threads in OpenSSL backend. - **added** — Support for external tokens without dlvsym in musl and argp detection with argp-standalone static-only library. - **changed** — Meson build system improvements including UUID header path detection, pkg-config for popt library discovery, and crypto backend library dependency propagation to all targets. ### v2.8.4 - Date: 2026-01-27 - Version: v2.8.4 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.4 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.4 - Labels: Machine-generated from commit messages — the vendor published no release notes Version 2.8.4. - **fixed** — Wrong device size status reports in cryptsetup and integritysetup. - **fixed** — bitlk no longer tries to use empty password for password keyslots. - **fixed** — integritysetup grow of bitmap protected devices. - **fixed** — gcc-16 warnings with fanalyzer. ### v2.8.3 - Date: 2025-12-19 - Version: v2.8.3 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.3 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.3 - Labels: Machine-generated from commit messages — the vendor published no release notes Version 2.8.3. - **fixed** — BITLK FVE validation on big-endian platforms. ### v2.8.2 - Date: 2025-12-18 - Version: v2.8.2 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.2 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.2 - Labels: Machine-generated from commit messages — the vendor published no release notes Version 2.8.2. - **added** — Support for PHMAC with integritysetup and cryptsetup. - **added** — Support for BitLocker clearkey. - **added** — Inline integrity flag set when no underlying dm-integrity device exists. - **fixed** — BitLocker handling of NULL passwords and validation of FVE metadata. - **fixed** — OPAL sed-opal ioctl submission to R/W file descriptor and suppressed confusing debug messages. - **fixed** — Handling of too long label and subsystem fields. - **fixed** — LUKS2 device status in inline HW mode and detached header. - **fixed** — Possible use of uninitialized variable and inline format data device. - **fixed** — Typos in integritysetup man page and volume-key-file help. - **fixed** — Key-size descriptions and explicit mention of units (bytes) for volume key in header. ### v2.8.2-rc0 - Date: 2025-12-12 - Version: v2.8.2-rc0 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.2-rc0 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.2-rc0 - Labels: Pre-release Version 2.8.2-rc0 ### v2.8.1 - Date: 2025-08-19 - Version: v2.8.1 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.1 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.1 - Labels: Machine-generated from commit messages — the vendor published no release notes Version 2.8.1. - **fixed** — Fix bug in parsing of tcrypt device in crypt_init_by_name. - **fixed** — Fix unlocking BitLocker with multibyte UTF8 characters in passphrase. - **fixed** — Fix detecting status of chained modes in tcrypt. - **fixed** — Fix luks2-external-tokens-path option for meson and define EXTERNAL_LUKS2_TOKENS_PATH for autoconf. - **fixed** — Fix wrongly generated config.h paths and tmpfiles installation when $prefix is set. - **changed** — Do not silently decrease PBKDF parallel cost (threads). - **changed** — Weaken warning about /dev/urandom in man pages as recent kernels behave much better. - **changed** — Documentation updates including clarification of --label, --sector-size, and --align-payload options, PBKDF hardcoded limits explanation, and removal of references to archeologic kernel versions. ### v2.8.1-rc0 - Date: 2025-08-13 - Version: v2.8.1-rc0 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.1-rc0 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.1-rc0 - Labels: Pre-release Version 2.8.1-rc0 ### v2.8.0 - Date: 2025-06-24 - Version: v2.8.0 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.0 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.0 Version 2.8.0. ### v2.8.0-rc1 - Date: 2025-06-16 - Version: v2.8.0-rc1 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.0-rc1 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.0-rc1 - Labels: Pre-release Version 2.8.0-rc1. ### v2.8.0-rc0 - Date: 2025-06-03 - Version: v2.8.0-rc0 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.0-rc0 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.0-rc0 - Labels: Pre-release Version 2.8.0-rc0. ### v2.7.5 - Date: 2024-09-02 - Version: v2.7.5 - Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.7.5 - Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.7.5 Version 2.7.5.