CVE-2026-43188

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: do not propagate page array emplacement errors as batch errors

When fscrypt is enabled, move_dirty_folio_in_page_array() may fail

because it needs to allocate bounce buffers to store the encrypted

versions of each folio. Each folio beyond the first allocates its bounce

buffer with GFP_NOWAIT. Failures are common (and expected) under this

allocation mode; they should flush (not abort) the batch.

However, ceph_process_folio_batch() uses the same `rc` variable for its

own return code and for capturing the return codes of its routine calls;

failing to reset `rc` back to 0 results in the error being propagated

out to the main writeback loop, which cannot actually tolerate any

errors here: once `ceph_wbc.pages` is allocated, it must be passed to

ceph_submit_write() to be freed. If it survives until the next iteration

(e.g. due to the goto being followed), ceph_allocate_page_array()'s

BUG_ON() will oops the worker.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References