ceph: do not propagate page array emplacement errors as batch errors
In the Linux kernel, the following vulnerability has been resolved: ceph: do not propagate page array emplacement errors as batch errors When fscrypt is enabled, move_dirty_folio_in_page_array() may fail because it needs to allocate bounce buffers to store the encrypted versions of each folio. Each folio beyond the first allocates its bounce buffer with GFP_NOWAIT. Failures are common (and expected) under this allocation mode; they should flush (not abort) the batch. However, ceph_process_folio_batch() uses the same `rc` variable for its own return code and for capturing the return codes of its routine calls; failing to reset `rc` back to 0 results in the error being propagated out to the main writeback loop, which cannot actually tolerate any errors here: once `ceph_wbc.pages` is allocated, it must be passed to ceph_submit_write() to be freed. If it survives until the next iteration (e.g. due to the goto being followed), ceph_allocate_page_array()'s BUG_ON() will oops the worker. Note that this failure mode is currently masked due to another bug (addressed next in this series) that prevents multiple encrypted folios from being selected for the same write. For now, just reset `rc` when redirtying the folio to prevent errors in move_dirty_folio_in_page_array() from propagating. Note that move_dirty_folio_in_page_array() is careful never to return errors on the first folio, so there is no need to check for that. After this change, ceph_process_folio_batch() no longer returns er
CVE-2026-43188
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-43188
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "ce80b76dd32764cc914975777e058d4fae4f0ea0",
"lessThan": "746840c87d76b614b14d9337c466ff022fc49823",
"versionType": "git"
},
{
"status": "affected",
"version": "ce80b76dd32764cc914975777e058d4fae4f0ea0",
"lessThan": "4c0d84c788d89c167abf0bf84fd37890c4c84f08",
"versionType": "git"
},
{
"status": "affected",
"version": "ce80b76dd32764cc914975777e058d4fae4f0ea0",
"lessThan": "707104682e3c163f7c14cdd6b07a3e95fb374759",
"versionType": "git"
},
{
"status": "affected",
"version": "0f2b2b7cacf888229cec19126e6791b11fb35f32",
"versionType": "git"
},
{
"status": "affected",
"version": "6.12.114",
"lessThan": "6.13",
"versionType": "semver"
}
],
"programFiles": [
"fs/ceph/addr.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/ceph/addr.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-43188
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #46269 · Revision 1
- Added to Heist Feed
- Publisher date