> Is there a solution for me? Would I have to produce a new "actual" 
> buffer, which will be encrypted and put to disk and then dropped.

I guess so, since page cache may be shared among others.  You need to
allocate new buffer, but you don't need to decrypt it.

enami.