CVE-2026-46066 Overview
CVE-2026-46066 is a Linux kernel vulnerability in the Ceph filesystem (CephFS) client. The flaw resides in ceph_process_folio_batch() and triggers a kernel panic via a BUG_ON assertion in ceph_submit_write(). The bug manifests during writeback on fscrypt-enabled CephFS files when a bounce buffer allocation fails under memory pressure. An off-by-one in ceph_wbc->num_ops causes the expected number of write extent operations to diverge from reality, panicking the kernel.
Critical Impact
Local denial of service through kernel panic affecting Linux systems with fscrypt-enabled CephFS mounts under memory pressure with specific write patterns.
Affected Products
- Linux kernel 6.18.16
- Linux kernel 6.19.6
- Linux kernel 7.0-rc1
Discovery Timeline
- 2026-05-27 - CVE-2026-46066 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46066
Vulnerability Analysis
The vulnerability is a kernel panic [Denial of Service] in the CephFS writeback path. When the filesystem is encrypted via fscrypt, move_dirty_folio_in_page_array() allocates a bounce buffer to hold ciphertext for each dirty folio added to a writeback batch.
Under memory pressure this allocation can fail. The caller, ceph_process_folio_batch(), redirties the folio and flushes the current batch, retrying it later. This recovery path is incomplete when the failed folio is discontiguous with the last folio successfully added to the batch.
In that case ceph_process_folio_batch() has already incremented ceph_wbc->num_ops to account for a new contiguous extent. Because the folio is never added, the counter overstates the number of write extent operations the request actually contains.
Root Cause
The ceph_submit_write() function enforces invariants via BUG_ON(ceph_wbc->op_idx + 1 != req->r_num_ops). When num_ops reflects an empty extent that was never populated, the assertion fails and the kernel panics. The fix decrements ceph_wbc->num_ops when move_dirty_folio_in_page_array() fails after a new extent counter was started.
Attack Vector
A local user with write access to an fscrypt-enabled CephFS mount can trigger the panic. Reproduction requires a 4 KiB written / 4 KiB skipped repeating write pattern combined with sufficient system memory pressure to cause bounce buffer allocation failures. The defect was latent since 2022 but was unmasked when commit cac190c7674f enabled multi-folio encrypted writeback in kernels 6.18.16, 6.19.6, and 7.0-rc1.
No synthetic exploitation code is provided. See the upstream commits referenced in Kernel Git Commit 6200f41, Kernel Git Commit a0d9555, and Kernel Git Commit ba12c1e for full technical context.
Detection Methods for CVE-2026-46066
Indicators of Compromise
- Kernel panic messages referencing BUG_ON in ceph_submit_write() with op_idx and r_num_ops mismatch.
- Stack traces containing ceph_process_folio_batch, move_dirty_folio_in_page_array, or writepages in the Ceph module.
- Repeated allocation failure warnings from the slab allocator preceding the panic on hosts mounting fscrypt-enabled CephFS.
Detection Strategies
- Inventory Linux hosts running kernel versions 6.18.16, 6.19.6, or 7.0-rc1 with the Ceph client module loaded.
- Audit CephFS mounts for fscrypt encryption policies applied via fscryptctl or ceph fs tooling.
- Correlate kernel crash dumps with workloads performing sparse writes on encrypted CephFS files.
Monitoring Recommendations
- Forward kernel.log, dmesg, and kdump output to a centralized log platform for panic pattern matching.
- Alert on unexpected node reboots affecting CephFS clients, particularly under high memory utilization.
- Track memory pressure metrics (MemAvailable, slab failures) on CephFS client nodes to identify pre-panic conditions.
How to Mitigate CVE-2026-46066
Immediate Actions Required
- Apply the upstream stable kernel patches that decrement ceph_wbc->num_ops when move_dirty_folio_in_page_array() fails.
- Identify and reboot hosts running affected kernels 6.18.16, 6.19.6, or 7.0-rc1 onto patched builds.
- Reduce memory pressure on CephFS client nodes until patched kernels are deployed.
Patch Information
The fix is committed upstream in Kernel Git Commit 6200f41, Kernel Git Commit a0d9555, and Kernel Git Commit ba12c1e. The patch corrects the off-by-one in ceph_wbc->num_ops accounting when bounce buffer allocation fails for a discontiguous folio.
Workarounds
- Temporarily disable fscrypt encryption on affected CephFS mounts where feasible.
- Avoid sparse write patterns (such as 4 KiB written / 4 KiB skipped) against encrypted CephFS files until patched.
- Increase available memory or tune vm.min_free_kbytes to reduce the likelihood of bounce buffer allocation failures.
# Verify kernel version and patch status on CephFS client nodes
uname -r
modinfo ceph | grep -E '^(version|srcversion)'
grep -i ceph /proc/mounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
