# cryptsetup v2.8.7

- Product: cryptsetup (https://whatsnew.fyi/product/cryptsetup)
- Vendor: cryptsetup
- Date: 2026-07-21
- Version: v2.8.7
- Original notes: https://gitlab.com/cryptsetup/cryptsetup/-/tags/v2.8.7
- Permalink: https://whatsnew.fyi/product/cryptsetup/releases/v2.8.7
- Labels: Machine-generated from commit messages — the vendor published no release notes

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

Version 2.8.7.

- **added** — Add keyring key type and load volume keys in intermediary keyring linked in thread keyring.
- **added** — Support Aria and Camellia ciphers in libgcrypt backend.
- **added** — Add storage wrappers option to use DMCRYPT wrapper only and add fallback to dmcrypt in LUKS21 keyslot processing.
- **added** — integritysetup: support --integrity-legacy-hmac in open.
- **fixed** — Fix tcrypt, luks2, and OpenSSL backend security issues including safe allocation for password pool, length overflow checks, buffer size validation, HMAC return value checks, PBKDF2 cast overflow, and json keyslot leak on error path.
- **fixed** — Fix reencryption name helper check and improve LUKS_check_cipher validation.
- **changed** — Remove logic for AF_ALG dependence in tcrypt and luks2, and do not print specific AF_ALG info in cryptsetup cipher benchmark.
- **changed** — Switch LUKS2 reencryption and convert code to more capable LUKS_check_cipher check.
- **changed** — Allow cached volume key in activation with CRYPT_KC_TYPE_KEY only and ensure CRYPT_VOLUME_KEY_NO_SEGMENT flag always creates unbound keyslot.
- **fixed** — Fix integrity shift overflow test and --tries option use.