CVE-2026-43188: Linux Kernel Ceph Error Handling Flaw

CVE-2026-43188 Overview

CVE-2026-43188 is a Linux kernel vulnerability in the Ceph distributed filesystem client. The flaw resides in the writeback logic when fscrypt filesystem encryption is enabled. Specifically, ceph_process_folio_batch() improperly propagates page array emplacement errors as batch errors. When move_dirty_folio_in_page_array() fails to allocate a GFP_NOWAIT bounce buffer for an encrypted folio, the failure escapes to the main writeback loop. The loop cannot tolerate errors at that stage, leading to a BUG_ON() in ceph_allocate_page_array() and a kernel oops in the writeback worker.

Critical Impact
Local denial of service through a kernel oops in the Ceph writeback worker on systems mounting fscrypt-enabled Ceph filesystems under memory pressure.

Affected Products

Linux kernel Ceph client (fs/ceph) with fscrypt enabled
Stable kernel branches receiving the referenced backports
Systems mounting CephFS with filesystem-level encryption

Discovery Timeline

2026-05-06 - CVE-2026-43188 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43188

Vulnerability Analysis

The defect lies in the Ceph client writeback path under fscrypt. When encryption is active, each dirty folio queued for writeback requires a bounce buffer to hold its encrypted contents. The first bounce buffer allocates with normal flags, but subsequent folios in the same batch use GFP_NOWAIT. Allocation failures with GFP_NOWAIT are routine under memory pressure and signal the caller to flush the current batch rather than abort.

ceph_process_folio_batch() reuses a single rc variable to track both its own return value and return codes from helper calls. When move_dirty_folio_in_page_array() returns a non-zero code on a redirty path, rc is never reset to zero before control flows to the caller. The error then surfaces in the main writeback loop, which has no safe recovery once ceph_wbc.pages has been allocated.

Root Cause

The root cause is improper error handling [CWE-755] combined with shared variable reuse across distinct error semantics. The redirty-and-flush path is a benign control-flow event, not a fatal error, but the function fails to distinguish the two. Once pages is allocated, the array must be passed to ceph_submit_write() for cleanup. If a subsequent iteration runs with pages still live, ceph_allocate_page_array() triggers its BUG_ON() assertion.

Attack Vector

The vulnerability is triggered locally and unintentionally rather than through targeted exploitation. A user with write access to a CephFS mount that has fscrypt enabled can induce the condition by performing concurrent writes to encrypted files while the system is under memory pressure. The current bug is partially masked by a separate defect that prevents multiple encrypted folios from being selected for the same write, addressed in a follow-up patch in the same series.

The fix resets rc to zero when redirtying the folio, ensuring move_dirty_folio_in_page_array() failures no longer propagate. After the change, ceph_process_folio_batch() returns no errors, and the only remaining failure indicator is locked_pages == 0, which the caller already handles. Refer to the upstream commits 4c0d84c, 7071046, and 746840c for the patch series.

Detection Methods for CVE-2026-43188

Indicators of Compromise

Kernel oops messages referencing ceph_allocate_page_array or ceph_process_folio_batch in dmesg or journal logs
BUG_ON() traces originating from the Ceph writeback worker thread
Stalled or hung writeback on CephFS mounts that use fscrypt

Detection Strategies

Monitor kernel logs for BUG: and Oops: entries with stack frames inside fs/ceph/addr.c
Correlate writeback worker crashes with periods of memory pressure and active CephFS write workloads
Track running kernel versions across the fleet to identify hosts that lack the upstream fix

Monitoring Recommendations

Forward kern.crit and kern.err syslog facilities to a centralized logging or SIEM platform for kernel oops detection
Alert on Ceph client mount transitions to read-only state, which can follow a writeback worker fault
Track vmstat page allocation failure counters on hosts running CephFS with encryption enabled

How to Mitigate CVE-2026-43188

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 4c0d84c788d8, 707104682e3c, and 746840c87d76
Update to a stable kernel release that includes the full Ceph fscrypc writeback fix series
Inventory hosts mounting CephFS with fscrypt to prioritize patch deployment

Patch Information

The fix was committed to the upstream Linux kernel and backported to stable branches. The patch resets the local rc variable to zero on the redirty path so allocation failures in move_dirty_folio_in_page_array() no longer propagate to the writeback loop. See the Kernel Git Commit 4c0d84c, Kernel Git Commit 7071046, and Kernel Git Commit 746840c for the complete patch set.

Workarounds

Disable fscrypt on CephFS mounts where filesystem-level encryption is not strictly required
Reduce memory pressure on Ceph client hosts by tuning vm.min_free_kbytes and limiting concurrent writers
Restrict workloads that trigger heavy parallel writes against encrypted CephFS directories until kernels are updated

bash

# Verify running kernel and check for the fix
uname -r
git log --oneline v5.15.. -- fs/ceph/addr.c | grep -E '4c0d84c|7071046|746840c'

# Identify CephFS mounts using fscrypt
mount -t ceph
for m in $(awk '$3=="ceph"{print $2}' /proc/mounts); do
  echo "Mount: $m"
  ls -la "$m" 2>/dev/null | head -5
done