Executive brief
A vulnerability in the Linux kernel's Ceph file system component could allow a local user to cause a system crash. When disk encryption is enabled, certain memory allocation failures that should be handled gracefully instead cause the system to encounter a fatal error. This results in a denial-of-service condition, impacting the availability of the affected system.
Technical details
A logic error in the Ceph file system's writeback loop (fs/ceph/addr.c) fails to reset a return code variable after a non-fatal allocation failure in move_dirty_folio_in_page_array(). When fscrypt is active, bounce buffer allocations using GFP_NOWAIT may fail under memory pressure. If the return code is not reset, the error propagates to the main writeback loop, causing it to skip necessary cleanup and eventually trigger a BUG_ON() in ceph_allocate_page_array() during the next iteration. This results in a kernel oops and worker thread termination. The issue has been patched by ensuring the return code is reset when a folio is redirtied.
Affected products
- Linux Linux Kernel 6.15 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-01-25: other: Patch authored
- 2026-05-06: advisory: CVE published by kernel.org
- 2026-05-11: other: NVD analysis completed