{"cve":"CVE-2026-43188","nvd":{"published":"2026-05-06T12:16:37.600","modified":"2026-10-21T13:18:51.113","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nceph: do not propagate page array emplacement errors as batch errors\n\nWhen fscrypt is enabled, move_dirty_folio_in_page_array() may fail\nbecause it needs to allocate bounce buffers to store the encrypted\nversions of each folio. Each folio beyond the first allocates its bounce\nbuffer with GFP_NOWAIT. Failures are common (and expected) under this\nallocation mode; they should flush (not abort) the batch.\n\nHowever, ceph_process_folio_batch() uses the same `rc` variable for its\nown return code and for capturing the return codes of its routine calls;\nfailing to reset `rc` back to 0 results in the error being propagated\nout to the main writeback loop, which cannot actually tolerate any\nerrors here: once `ceph_wbc.pages` is allocated, it must be passed to\nceph_submit_write() to be freed. If it survives until the next iteration\n(e.g. due to the goto being followed), ceph_allocate_page_array()'s\nBUG_ON() will oops the worker.\n\nNote that this failure mode is currently masked due to another bug\n(addressed next in this series) that prevents multiple encrypted folios\nfrom being selected for the same write.\n\nFor now, just reset `rc` when redirtying the folio to prevent errors in\nmove_dirty_folio_in_page_array() from propagating. Note that\nmove_dirty_folio_in_page_array() is careful never to return errors on\nthe first folio, so there is no need to check for that. After this\nchange, ceph_process_folio_batch() no longer returns errors; its only\nremaining failure indicator is `locked_pages == 0`, which the caller\nalready handles correctly.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/4c0d84c788d89c167abf0bf84fd37890c4c84f08","https://git.kernel.org/stable/c/707104682e3c163f7c14cdd6b07a3e95fb374759","https://git.kernel.org/stable/c/746840c87d76b614b14d9337c466ff022fc49823"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-43188","score":0.0016,"percentile":0.05119,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}