# Matthew Garrett proposes signed hibernation to enable lockdown without resume attacks

> **Key takeaway:** A new kernel patch set would allow lockdown mode to safely re-enable hibernation by cryptographically verifying resume images and blocking downgrade attacks to older kernels.

**Published:** 2026-11-06T18:51:28+00:00 
**Source:** Linux Weekly News (LWN.net) 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/matthew-garrett-proposes-signed-hibernation-to-enable-lockdo.html 

## Summary
Matthew Garrett has published a patch set that addresses a long-standing limitation in the Linux kernel's lockdown security feature, which currently disables hibernation entirely because resumed memory images cannot be trusted. The proposed solution cryptographically signs hibernation images so the kernel can verify their integrity on resume, preventing attackers from injecting malicious code into the restored system state. The implementation also guards against downgrade attacks where an adversary might boot an older, less secure kernel version to bypass newer protections. This work would restore hibernation functionality on systems running in lockdown mode, which is increasingly relevant for distributions and hardware platforms that enforce stricter security postures.

The patch set touches multiple kernel subsystems including hibernation core code, the lockdown module, and key management infrastructure. Garrett's approach must solve the dual problem of ensuring the resumed image matches the running kernel and preventing rollback to vulnerable versions. The solution has not yet been merged and will require review from maintainers of the affected subsystems before it can reach mainline.

## How signed hibernation protects lockdown mode
- **Hibernation image signing:** The kernel generates a cryptographic signature over the hibernation image at suspend time, storing the key material in a way that only the same kernel version can validate it on resume.
- **Downgrade attack prevention:** The verification mechanism binds the hibernation image to the specific kernel version that created it, blocking attempts to resume under an older kernel with known vulnerabilities or weaker lockdown policies.
- **Lockdown integration:** The patches modify the lockdown subsystem to conditionally allow hibernation when the signing and verification pipeline is active, rather than unconditionally disabling the feature.
- **Key lifecycle management:** The implementation handles key generation, storage, and destruction across the suspend-resume cycle, ensuring that verification keys are not exposed to attackers with physical access between power-off and resume.

## Why it matters
For Linux distributions that ship with lockdown enabled by default, such as Fedora and Ubuntu on Secure Boot systems, this change would restore hibernation as a viable power management option without compromising security boundaries. Server and workstation administrators who rely on lockdown for compliance or threat modeling would gain a power-saving feature that has been unavailable to them, while embedded and mobile Linux devices with strict security requirements could finally deploy hibernation in production environments.