CVE-2026-46066 - Vulnerability Details

- ceph: fix num_ops off-by-one when crypto allocation fails

Description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix num_ops off-by-one when crypto allocation fails

move_dirty_folio_in_page_array() may fail if the file is encrypted, the
dirty folio is not the first in the batch, and it fails to allocate a
bounce buffer to hold the ciphertext. When that happens,
ceph_process_folio_batch() simply redirties the folio and flushes the
current batch -- it can retry that folio in a future batch.

However, if this failed folio is not contiguous with the last folio that
did make it into the batch, then ceph_process_folio_batch() has already
incremented `ceph_wbc->num_ops`; because it doesn't follow through and
add the discontiguous folio to the array, ceph_submit_write() -- which
expects that `ceph_wbc->num_ops` accurately reflects the number of
contiguous ranges (and therefore the required number of "write extent"
ops) in the writeback -- will panic the kernel:

BUG_ON(ceph_wbc->op_idx + 1 != req->r_num_ops);

This issue can be reproduced on affected kernels by writing to
fscrypt-enabled CephFS file(s) with a 4KiB-written/4KiB-skipped/repeat
pattern (total filesize should not matter) and gradually increasing the
system's memory pressure until a bounce buffer allocation fails.

Fix this crash by decrementing `ceph_wbc->num_ops` back to the correct
value when move_dirty_folio_in_page_array() fails, but the folio already
started counting a new (i.e. still-empty) extent.

The defect corrected by this patch has existed since 2022 (see first
`Fixes:`), but another bug blocked multi-folio encrypted writeback until
recently (see second `Fixes:`). The second commit made it into 6.18.16,
6.19.6, and 7.0-rc1, unmasking the panic in those versions. This patch
therefore fixes a regression (panic) introduced by cac190c7674f.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains an off‑by‑one error in the CephFS writeback path when a crypto bounce buffer allocation fails. If the failed folio is not contiguous with the last successful one, the counter tracking the number of write extents remains incremented, and a kernel assertion later expects the counter to match the number of operations. The mismatch triggers a BUG_ON that crashes the kernel. An attacker can induce this by writing to an fscrypt‑enabled CephFS file with alternating 4 KiB blocks and then applying memory pressure until the allocation fails. The crash results in a denial of service by rendering the node unusable until reboot. This is a pure crash condition and does not provide direct code execution or privilege escalation.

Affected Systems

Affected systems are Linux kernel builds that include the CephFS driver and have not applied the recent patch. The vulnerability was first identified in 2022; the regression was revealed in kernel releases 6.18.16, 6.19.6 and 7.0‑rc1. All subsequent kernel versions incorporate the fix that correctly decrements the operation counter when the bounce buffer allocation fails. Systems running earlier kernel releases without the patch are susceptible.

Risk and Exploitability

Risk assessment shows that the CVSS score of 5.5 indicates moderate severity. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog. The attack vector requires privileged or local access to perform the crafted write operations and induce memory pressure, so the exploitation likelihood is moderate for an internal adversary. Nonetheless, any system exposed to CephFS with fscrypt enabled should promptly apply the patched kernel to avoid the crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d55207717ded95c8f2760a30e93319fa313186e6`	affected	< 6200f41d6fcf2ac7e24866431e381cbc914560e4
`d55207717ded95c8f2760a30e93319fa313186e6`	affected	< ba12c1e578890f6337a415b7dedf476c6d455105
`d55207717ded95c8f2760a30e93319fa313186e6`	affected	< a0d9555bf9eaeba34fe6b6bb86f442fe08ba3842

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.18.30`	unaffected	≤ 6.18.*
`7.0.4`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d55207717ded95c8f2760a30e93319fa313186e6,6200f41d6fcf2ac7e24866431e381cbc914560e4)`	affected	code_commit	—
`[d55207717ded95c8f2760a30e93319fa313186e6,ba12c1e578890f6337a415b7dedf476c6d455105)`	affected	code_commit	—
`[d55207717ded95c8f2760a30e93319fa313186e6,a0d9555bf9eaeba34fe6b6bb86f442fe08ba3842)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.6`	affected	semver	—
`[0,6.6)`	unaffected	generic	—
`[6.18.30,6.19.0)`	unaffected	semver	—
`[7.0.4,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the CephFS off‑by‑one patch (e.g., 6.18.16+ or later selections that incorporate the fix), ensuring the system runs a kernel from the series 6.18, 6.19 or 7.0 where the issue is resolved.
If an update is not immediately feasible, refrain from performing large encrypted write operations on CephFS and avoid applying significant memory pressure until the patch is available.
Consider temporarily disabling fscrypt on CephFS mounts if you must stay on an unpatched kernel, as the vulnerability relies on encrypted data and crypto buffer allocation failure.

Generated by OpenCVE AI on May 28, 2026 at 03:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/6200f41d6fcf2ac7e24866431e381cbc914560e4
https://git.kernel.org/stable/c/a0d9555bf9eaeba34fe6b6bb86f442fe08ba3842
https://git.kernel.org/stable/c/ba12c1e578890f6337a415b7dedf476c6d455105
https://lore.kernel.org/linux-cve-announce/2026052757-CVE-2026-46066-0f6f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46066
https://www.cve.org/CVERecord?id=CVE-2026-46066

History

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-193
References		https://lore.kernel.org/linux-cve-announce/2026052757-CVE-2026-46066-0f6f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46066 https://www.cve.org/CVERecord?id=CVE-2026-46066
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ceph: fix num_ops off-by-one when crypto allocation fails move_dirty_folio_in_page_array() may fail if the file is encrypted, the dirty folio is not the first in the batch, and it fails to allocate a bounce buffer to hold the ciphertext. When that happens, ceph_process_folio_batch() simply redirties the folio and flushes the current batch -- it can retry that folio in a future batch. However, if this failed folio is not contiguous with the last folio that did make it into the batch, then ceph_process_folio_batch() has already incremented `ceph_wbc->num_ops`; because it doesn't follow through and add the discontiguous folio to the array, ceph_submit_write() -- which expects that `ceph_wbc->num_ops` accurately reflects the number of contiguous ranges (and therefore the required number of "write extent" ops) in the writeback -- will panic the kernel: BUG_ON(ceph_wbc->op_idx + 1 != req->r_num_ops); This issue can be reproduced on affected kernels by writing to fscrypt-enabled CephFS file(s) with a 4KiB-written/4KiB-skipped/repeat pattern (total filesize should not matter) and gradually increasing the system's memory pressure until a bounce buffer allocation fails. Fix this crash by decrementing `ceph_wbc->num_ops` back to the correct value when move_dirty_folio_in_page_array() fails, but the folio already started counting a new (i.e. still-empty) extent. The defect corrected by this patch has existed since 2022 (see first `Fixes:`), but another bug blocked multi-folio encrypted writeback until recently (see second `Fixes:`). The second commit made it into 6.18.16, 6.19.6, and 7.0-rc1, unmasking the panic in those versions. This patch therefore fixes a regression (panic) introduced by cac190c7674f.
Title		ceph: fix num_ops off-by-one when crypto allocation fails
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6200f41d6fcf2ac7e24866431e381cbc914560e4 https://git.kernel.org/stable/c/a0d9555bf9eaeba34fe6b6bb86f442fe08ba3842 https://git.kernel.org/stable/c/ba12c1e578890f6337a415b7dedf476c6d455105

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:57:41.865Z

Updated: 2026-06-14T17:51:51.002Z

Reserved: 2026-05-13T15:03:33.095Z

Link: CVE-2026-46066

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-27T14:17:27.320

Modified: 2026-05-27T14:48:03.013

Link: CVE-2026-46066

Redhat

Severity : Moderate

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-46066 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T05:00:08Z

Weaknesses

CWE-193
Off-by-one Error

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object