CVE-2026-43188

{"id": "CVE-2026-43188", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "746840c87d76b614b14d9337c466ff022fc49823", "versionType": "git"}, {"status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "4c0d84c788d89c167abf0bf84fd37890c4c84f08", "versionType": "git"}, {"status": "affected", "version": "ce80b76dd32764cc914975777e058d4fae4f0ea0", "lessThan": "707104682e3c163f7c14cdd6b07a3e95fb374759", "versionType": "git"}, {"status": "affected", "version": "0f2b2b7cacf888229cec19126e6791b11fb35f32", "versionType": "git"}, {"status": "affected", "version": "6.12.114", "lessThan": "6.13", "versionType": "semver"}], "programFiles": ["fs/ceph/addr.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ceph/addr.c"], "defaultStatus": "affected"}]}], "published": "2026-05-06T12:16:37.600", "references": [{"url": "https://git.kernel.org/stable/c/4c0d84c788d89c167abf0bf84fd37890c4c84f08", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/746840c87d76b614b14d9337c466ff022fc49823", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: do not propagate page array emplacement errors as batch errors\n\nWhen fscrypt is enabled, move_dirty_folio_in_page_array() may fail\nbecause it needs to allocate bounce buffers to store the encrypted\nversions of each folio. Each folio beyond the first allocates its bounce\nbuffer with GFP_NOWAIT. Failures are common (and expected) under this\nallocation mode; they should flush (not abort) the batch.\n\nHowever, ceph_process_folio_batch() uses the same `rc` variable for its\nown return code and for capturing the return codes of its routine calls;\nfailing to reset `rc` back to 0 results in the error being propagated\nout to the main writeback loop, which cannot actually tolerate any\nerrors here: once `ceph_wbc.pages` is allocated, it must be passed to\nceph_submit_write() to be freed. If it survives until the next iteration\n(e.g. due to the goto being followed), ceph_allocate_page_array()'s\nBUG_ON() will oops the worker.\n\nNote that this failure mode is currently masked due to another bug\n(addressed next in this series) that prevents multiple encrypted folios\nfrom being selected for the same write.\n\nFor now, just reset `rc` when redirtying the folio to prevent errors in\nmove_dirty_folio_in_page_array() from propagating. Note that\nmove_dirty_folio_in_page_array() is careful never to return errors on\nthe first folio, so there is no need to check for that. After this\nchange, ceph_process_folio_batch() no longer returns errors; its only\nremaining failure indicator is `locked_pages == 0`, which the caller\nalready handles correctly."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nceph: no propagar errores de emplazamiento de array de p\u00e1ginas como errores de lote\n\nCuando fscrypt est\u00e1 habilitado, move_dirty_folio_in_page_array() puede fallar porque necesita asignar b\u00faferes de rebote para almacenar las versiones cifradas de cada folio. Cada folio m\u00e1s all\u00e1 del primero asigna su b\u00fafer de rebote con GFP_NOWAIT. Los fallos son comunes (y esperados) bajo este modo de asignaci\u00f3n; deber\u00edan vaciar (no abortar) el lote.\n\nSin embargo, ceph_process_folio_batch() utiliza la misma variable \u2019rc\u2019 para su propio c\u00f3digo de retorno y para capturar los c\u00f3digos de retorno de sus llamadas a rutina; no restablecer \u2019rc\u2019 a 0 resulta en que el error se propaga al bucle principal de writeback, el cual no puede tolerar ning\u00fan error aqu\u00ed: una vez que \u2019ceph_wbc.pages\u2019 es asignado, debe ser pasado a ceph_submit_write() para ser liberado. Si sobrevive hasta la siguiente iteraci\u00f3n (por ejemplo, debido a que se sigue el goto), el BUG_ON() de ceph_allocate_page_array() har\u00e1 que el worker falle.\n\nTenga en cuenta que este modo de fallo est\u00e1 actualmente enmascarado debido a otro error (abordado a continuaci\u00f3n en esta serie) que impide que m\u00faltiples folios cifrados sean seleccionados para la misma escritura.\n\nPor ahora, simplemente restablezca \u2019rc\u2019 al volver a marcar el folio como sucio para evitar que los errores en move_dirty_folio_in_page_array() se propaguen. Tenga en cuenta que move_dirty_folio_in_page_array() tiene cuidado de nunca devolver errores en el primer folio, por lo que no hay necesidad de comprobar eso. Despu\u00e9s de este cambio, ceph_process_folio_batch() ya no devuelve errores; su \u00fanico indicador de fallo restante es \u2019locked_pages == 0\u2019, que el llamador ya maneja correctamente."}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}