# cryptsetup v2.8.5

- Product: cryptsetup (https://whatsnew.fyi/product/cryptsetup)
- Vendor: cryptsetup
- Date: 2026-04-02
- Version: v2.8.5
- Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.5
- Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.5
- Labels: Machine-generated from commit messages — the vendor published no release notes

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

Version 2.8.5.

- **fixed** — UUID verification of resumed devices now matches UUID stored in metadata.
- **fixed** — Reading from wrong image offset, fvault2 metadata block offset check, and LUKS2 reencryption lock and data offset functions.
- **fixed** — crypt_resize() data leak on error path, wiping of larger Veracrypt password pool, and crypt_capi_to_cipher() prefix validation.
- **fixed** — Kernel crypto backend sa.salg_type snprintf check, OpenSSL CTX_dup failure handling, device_alignment for NULL device, and DM_INTEGRITY union access in _reload_device().
- **fixed** — Keyring name buffer size in DM table with proper bounds checking, flags initialization to prevent reading uninitialized values on dm_flags() failure, and integrity sector size overflow from disk reads.
- **fixed** — strtoll() failure checking, fvault2 key unwrapping memory allocation, OpenSSL RAND_bytes buffer size validation, and posix_fallocate error reporting.
- **fixed** — Verity tree hash file flushing between levels and OpenSSL crypto backend build compatibility with LibreSSL.
- **changed** — Use portable bitops.h instead of Linux endian.h in utf8.c and increased number of allowed threads in OpenSSL backend.
- **added** — Support for external tokens without dlvsym in musl and argp detection with argp-standalone static-only library.
- **changed** — Meson build system improvements including UUID header path detection, pkg-config for popt library discovery, and crypto backend library dependency propagation to all targets.