Vulnerability-Lookup

GHSA-QPXP-QJRM-7F7R

Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-05-11 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

ceph: do not propagate page array emplacement errors as batch errors

When fscrypt is enabled, move_dirty_folio_in_page_array() may fail because it needs to allocate bounce buffers to store the encrypted versions of each folio. Each folio beyond the first allocates its bounce buffer with GFP_NOWAIT. Failures are common (and expected) under this allocation mode; they should flush (not abort) the batch.

However, ceph_process_folio_batch() uses the same rc variable for its own return code and for capturing the return codes of its routine calls; failing to reset rc back to 0 results in the error being propagated out to the main writeback loop, which cannot actually tolerate any errors here: once ceph_wbc.pages is allocated, it must be passed to ceph_submit_write() to be freed. If it survives until the next iteration (e.g. due to the goto being followed), ceph_allocate_page_array()'s BUG_ON() will oops the worker.

Note that this failure mode is currently masked due to another bug (addressed next in this series) that prevents multiple encrypted folios from being selected for the same write.

For now, just reset rc when redirtying the folio to prevent errors in move_dirty_folio_in_page_array() from propagating. Note that move_dirty_folio_in_page_array() is careful never to return errors on the first folio, so there is no need to check for that. After this change, ceph_process_folio_batch() no longer returns errors; its only remaining failure indicator is locked_pages == 0, which the caller already handles correctly.

Severity ?

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-43188"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T12:16:37Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: do not propagate page array emplacement errors as batch errors\n\nWhen fscrypt is enabled, move_dirty_folio_in_page_array() may fail\nbecause it needs to allocate bounce buffers to store the encrypted\nversions of each folio. Each folio beyond the first allocates its bounce\nbuffer with GFP_NOWAIT. Failures are common (and expected) under this\nallocation mode; they should flush (not abort) the batch.\n\nHowever, ceph_process_folio_batch() uses the same `rc` variable for its\nown return code and for capturing the return codes of its routine calls;\nfailing to reset `rc` back to 0 results in the error being propagated\nout to the main writeback loop, which cannot actually tolerate any\nerrors here: once `ceph_wbc.pages` is allocated, it must be passed to\nceph_submit_write() to be freed. If it survives until the next iteration\n(e.g. due to the goto being followed), ceph_allocate_page_array()\u0027s\nBUG_ON() will oops the worker.\n\nNote that this failure mode is currently masked due to another bug\n(addressed next in this series) that prevents multiple encrypted folios\nfrom being selected for the same write.\n\nFor now, just reset `rc` when redirtying the folio to prevent errors in\nmove_dirty_folio_in_page_array() from propagating. Note that\nmove_dirty_folio_in_page_array() is careful never to return errors on\nthe first folio, so there is no need to check for that. After this\nchange, ceph_process_folio_batch() no longer returns errors; its only\nremaining failure indicator is `locked_pages == 0`, which the caller\nalready handles correctly.",
  "id": "GHSA-qpxp-qjrm-7f7r",
  "modified": "2026-05-11T21:31:30Z",
  "published": "2026-05-06T12:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43188"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4c0d84c788d89c167abf0bf84fd37890c4c84f08"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/746840c87d76b614b14d9337c466ff022fc49823"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-43188 (GCVE-0-2026-43188)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-05-11 22:19

Title

ceph: do not propagate page array emplacement errors as batch errors

Summary

In the Linux kernel, the following vulnerability has been resolved: ceph: do not propagate page array emplacement errors as batch errors When fscrypt is enabled, move_dirty_folio_in_page_array() may fail because it needs to allocate bounce buffers to store the encrypted versions of each folio. Each folio beyond the first allocates its bounce buffer with GFP_NOWAIT. Failures are common (and expected) under this allocation mode; they should flush (not abort) the batch. However, ceph_process_folio_batch() uses the same `rc` variable for its own return code and for capturing the return codes of its routine calls; failing to reset `rc` back to 0 results in the error being propagated out to the main writeback loop, which cannot actually tolerate any errors here: once `ceph_wbc.pages` is allocated, it must be passed to ceph_submit_write() to be freed. If it survives until the next iteration (e.g. due to the goto being followed), ceph_allocate_page_array()'s BUG_ON() will oops the worker. Note that this failure mode is currently masked due to another bug (addressed next in this series) that prevents multiple encrypted folios from being selected for the same write. For now, just reset `rc` when redirtying the folio to prevent errors in move_dirty_folio_in_page_array() from propagating. Note that move_dirty_folio_in_page_array() is careful never to return errors on the first folio, so there is no need to check for that. After this change, ceph_process_folio_batch() no longer returns errors; its only remaining failure indicator is `locked_pages == 0`, which the caller already handles correctly.

Severity ?

No CVSS data available.

Assigner

Linux

References

3 references

URL	Tags
https://git.kernel.org/stable/c/746840c87d76b614b…
https://git.kernel.org/stable/c/4c0d84c788d89c167…
https://git.kernel.org/stable/c/707104682e3c163f7…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ce80b76dd32764cc914975777e058d4fae4f0ea0 , < 746840c87d76b614b14d9337c466ff022fc49823 (git) Affected: ce80b76dd32764cc914975777e058d4fae4f0ea0 , < 4c0d84c788d89c167abf0bf84fd37890c4c84f08 (git) Affected: ce80b76dd32764cc914975777e058d4fae4f0ea0 , < 707104682e3c163f7c14cdd6b07a3e95fb374759 (git)
Linux	Linux	Affected: 6.15 Unaffected: 0 , < 6.15 (semver) Unaffected: 6.18.16 , ≤ 6.18.* (semver) Unaffected: 6.19.6 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/addr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "746840c87d76b614b14d9337c466ff022fc49823",
              "status": "affected",
              "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0",
              "versionType": "git"
            },
            {
              "lessThan": "4c0d84c788d89c167abf0bf84fd37890c4c84f08",
              "status": "affected",
              "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0",
              "versionType": "git"
            },
            {
              "lessThan": "707104682e3c163f7c14cdd6b07a3e95fb374759",
              "status": "affected",
              "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/addr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: do not propagate page array emplacement errors as batch errors\n\nWhen fscrypt is enabled, move_dirty_folio_in_page_array() may fail\nbecause it needs to allocate bounce buffers to store the encrypted\nversions of each folio. Each folio beyond the first allocates its bounce\nbuffer with GFP_NOWAIT. Failures are common (and expected) under this\nallocation mode; they should flush (not abort) the batch.\n\nHowever, ceph_process_folio_batch() uses the same `rc` variable for its\nown return code and for capturing the return codes of its routine calls;\nfailing to reset `rc` back to 0 results in the error being propagated\nout to the main writeback loop, which cannot actually tolerate any\nerrors here: once `ceph_wbc.pages` is allocated, it must be passed to\nceph_submit_write() to be freed. If it survives until the next iteration\n(e.g. due to the goto being followed), ceph_allocate_page_array()\u0027s\nBUG_ON() will oops the worker.\n\nNote that this failure mode is currently masked due to another bug\n(addressed next in this series) that prevents multiple encrypted folios\nfrom being selected for the same write.\n\nFor now, just reset `rc` when redirtying the folio to prevent errors in\nmove_dirty_folio_in_page_array() from propagating. Note that\nmove_dirty_folio_in_page_array() is careful never to return errors on\nthe first folio, so there is no need to check for that. After this\nchange, ceph_process_folio_batch() no longer returns errors; its only\nremaining failure indicator is `locked_pages == 0`, which the caller\nalready handles correctly."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:19:32.944Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/746840c87d76b614b14d9337c466ff022fc49823"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c0d84c788d89c167abf0bf84fd37890c4c84f08"
        },
        {
          "url": "https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759"
        }
      ],
      "title": "ceph: do not propagate page array emplacement errors as batch errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43188",
    "datePublished": "2026-05-06T11:27:58.402Z",
    "dateReserved": "2026-05-01T14:12:55.991Z",
    "dateUpdated": "2026-05-11T22:19:32.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-QPXP-QJRM-7F7R

CVE-2026-43188 (GCVE-0-2026-43188)

Tags

Sightings

Nomenclature