CVE-2026-46066

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix num_ops off-by-one when crypto allocation fails

move_dirty_folio_in_page_array() may fail if the file is encrypted, the

dirty folio is not the first in the batch, and it fails to allocate a

bounce buffer to hold the ciphertext. When that happens,

ceph_process_folio_batch() simply redirties the folio and flushes the

current batch -- it can retry that folio in a future batch.

However, if this failed folio is not contiguous with the last folio that

did make it into the batch, then ceph_process_folio_batch() has already

incremented `ceph_wbc->num_ops`; because it doesn't follow through and

add the discontiguous folio to the array, ceph_submit_write() -- which

expects that `ceph_wbc->num_ops` accurately reflects the number of

contiguous ranges (and therefore the required number of "write extent"

ops) in the writeback -- will panic the kernel:

BUG_ON(ceph_wbc->op_idx + 1 != req->r_num_ops);

This issue can

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References