Executive brief
A vulnerability in the Linux kernel's Ceph file system component can cause a system crash (kernel panic) under specific conditions. This occurs when the system is under high memory pressure while writing to encrypted files, leading to a failure in allocating temporary storage buffers. An exploit or accidental trigger of this bug would result in a complete service outage for the affected server.
Technical details
A logic error in the Ceph file system client's writeback path leads to a kernel panic via a BUG_ON assertion. When 'move_dirty_folio_in_page_array' fails to allocate a bounce buffer for an encrypted folio that is not contiguous with the previous batch, the 'num_ops' counter is incremented but the folio is not added to the request. This creates a mismatch between the expected and actual number of operations in 'ceph_submit_write'. The issue is specifically triggered on fscrypt-enabled CephFS volumes under memory pressure. Patches have been released for various stable kernel branches to correctly decrement the operation counter upon allocation failure.
Affected products
- Linux Linux Kernel 6.18.16, 6.19.6, 7.0-rc1
Timeline
- 2026-05-05: patched: Initial fix authored
- 2026-05-27: disclosed: CVE published